Finding the flaw first

Attackers now often exploit a weakness before there is a fix for it. The same AI that speeds them up is finding and patching flaws faster than people can. Where the defensive side stands.

Analysis November 9, 2026 3 min read

A steel close helmet with a fluted visor and narrow eye slits — Close helmet in Maximilian style, Germany, about 1520. Cleveland Museum of Art, CC0.

For most of the history of software security, defenders had a head start. A flaw would be found, a fix would ship, and attackers would take weeks or months to use it. That head start is gone.

Mandiant, Google’s incident response arm, measured the average time between a vulnerability being disclosed and being exploited at 63 days in 2018 and 2019. By 2023 it was five days. In its 2026 report it estimates the average for 2025 at minus seven days: on average, exploitation began before a fix existed. VulnCheck found that in the first half of 2025, nearly a third of vulnerabilities known to be exploited showed signs of exploitation on or before the day they were published.

When the attacker moves first, the only way to win is to find the flaw before anyone else does. That is where AI on the defensive side has come furthest.

A model finds a real bug

In late 2024, Google’s Big Sleep, an AI agent built by Project Zero and DeepMind, found an exploitable memory bug in SQLite, one of the most widely used pieces of software in the world. It was reported in early October and fixed the same day, before any release shipped it. Google called it “the first public example of an AI agent finding a previously unknown exploitable memory-safety issue” in widely used real-world software.

In July 2025 Google went further. Working from its threat intelligence team’s leads, Big Sleep found another critical SQLite flaw, CVE-2025-6965, that Google says was known only to attackers and about to be used. “We believe this is the first time an AI agent has been used to directly foil efforts to exploit a vulnerability in the wild,” Google wrote. It has not said who the attackers were or how the attack was stopped, so that remains Google’s own account.

A microscope photograph of a processor die, its circuits in fine bands — The surface is vast. The flaws are tiny. Machines are now reading it line by line.Processor die photograph by Fritzchens Fritz, via Wikimedia Commons, CC0.

Find it and fix it, in 45 minutes

In August 2025 at DEF CON, DARPA ran the final of its AI Cyber Challenge, a two-year competition for systems that find and fix flaws on their own. Team Atlanta, from Georgia Tech, KAIST, POSTECH and Samsung Research, won $4 million. Trail of Bits came second and Theori third.

The systems found 54 of the 63 flaws planted in the competition code and patched 43 of them.
They also found 18 real vulnerabilities nobody had planted, and provided 11 patches.
A patch took about 45 minutes on average, at about $152 per task.
All seven finalists’ systems are being released as open source.

An AI at the top of the bounty board

In June 2025, XBOW, an autonomous penetration-testing system, reached the top of HackerOne’s US leaderboard after submitting nearly 1,060 reports to real bug bounty programs. Its findings were automated and checked by its own validators, including a headless browser that confirms an attack actually runs. And, as HackerOne’s policy on automated tools requires, “our security team reviewed them pre-submission.” The leaderboard ranks reputation rather than earnings, and some researchers have urged caution about reading too much into the milestone.

The labs turn to defense

The companies building the models are now pointing them at the problem directly. Google DeepMind’s CodeMender, announced in October 2025, writes patches and rewrites code to remove whole classes of bug, and sent 72 security fixes upstream in its first six months. DeepMind is clear about the limit: “Currently, all patches generated by CodeMender are reviewed by human researchers before they're submitted upstream.” OpenAI’s Aardvark, a security research agent, followed the same month, and OpenAI launched Daybreak in 2026 to put its cyber models in defenders’ hands.

Anthropic’s Project Glasswing, launched in April 2026 with partners across the industry, reported in May that about 50 partners had found more than 10,000 high or critical severity vulnerabilities in a month. Every high or critical finding is reproduced by Anthropic or an independent security firm before disclosure.

The pattern

Look across all of it and the same shape appears. The machine finds and drafts at a speed no team can match. Something independent checks that the finding is real. A person approves what goes out. The successes come from systems that keep all three.

Speed: test continuously, not once a year, because exploitation no longer waits.
Proof: a finding has to be demonstrated, not just suspected, before anyone acts on it.
A person: fixes are reviewed and approved by someone who answers for them.