Within hours, someone points a model at the diff between the old and new versions and gets a working exploit back. Your scanner flags the CVE the next morning, a ticket gets filed, and the fix is scheduled into next week's change window.
By then the exploit has been circulating for days. That was a fine enterprise lifestyle choice last year, but it's considered out of fashion nowadays.
And for good reason, as Michael Cembalest goes over in his "Patchmageddon" report from July 2026, which includes input from J.P. Models such as Anthropic's Mythos and OpenAI's GPT–5.5 now find previously unknown vulnerabilities at a scale no human research team can match.
Anthropic and its Project Glasswing partners found more than 10,000 new high- and critical-severity zero-days in the first month alone. At the same time, the exploitation clock shrank.
The note puts the median time from disclosure to first exploitation at around a year in 2021. Now it's down to one day in 2026, and projected to be one minute by 2027.
