AI is changing the economics of vulnerability discovery. Defenders should adapt now

KUALA LUMPUR, 6 AUGUST 2026 —

Recent announcements by major AI laboratories, combined with observable shifts in attacker behaviour, mark an inflection point in the economics of vulnerability discovery. CERT-EU is publishing this post to share how we read these developments, what they mean for Union entities and the wider community, and how we are adapting our own services in response.

It complements our Threat Landscape Report 2025 , which documented the continued dominance of vulnerability exploitation as an initial access vector against Union entities. In April 2026, Anthropic disclosed that Claude Mythos Preview — a cybersecurity-focused model it chose not to release publicly — had autonomously discovered thousands of high- and critical-severity vulnerabilities , including previously unknown zero-days in code dating back decades.

Rather than a public release, Anthropic distributed the model through Project Glasswing , a controlled programme providing access to twelve launch partners and over 40 additional organisations maintaining critical infrastructure, exclusively for defensive security work.

The same month, HackerOne — the world's largest bug bounty platform — suspended new submissions to its Internet Bug Bounty programme after AI-generated vulnerability reports, a mix of genuine discoveries and low-quality submissions, overwhelmed both triage capacity and remediation resources across the open-source ecosystem. The cURL project had already shut down its own bug bounty programme in January 2026 for similar reasons. This shift has been building for months.

According to Google's M-Trends 2026 report , the mean time to exploit newly disclosed vulnerabilities has dropped to an estimated negative seven days: exploitation is, on average, now occurring before a patch is even released. In 2018, that window was 63 days. The traditional cycle of discover, disclose, patch, deploy was designed for a slower adversary. That adversary no longer exists. None of this means that defenders are powerless.

The same AI capabilities that strengthen attackers can also strengthen defences, and defenders who adopt them systematically gain real ground. For code they control — in-house applications and open-source projects they maintain or contribute to — they can integrate AI-powered analysis into development pipelines and software development lifecycles, closing flaws before they ship.

For commercial software, they can use the same tools to identify vulnerabilities, report them to vendors through coordinated disclosure, and develop compensating controls and detections while awaiting patches. This is arguably the most significant opportunity defenders have had in many years, but only if they move quickly enough to seize it.

For organisations responsible for critical infrastructure — including our constituents, the Union entities (EU institutions, bodies, offices and agencies) — this acceleration demands a clear-eyed assessment of what has changed and a willingness to adapt how we approach the security of our internet-facing and third-party-exposed attack surface.

Just as AI models have transformed software engineering — writing, debugging, and shipping code at superhuman speed — the most powerful systems are now demonstrating the same leap in security research, matching and in some cases exceeding human researchers in vulnerability discovery and exploitation. When Anthropic benchmarked Claude Mythos Preview against vulnerabilities in Firefox 147's JavaScript engine, it developed working shell exploits 181 times out of several hundred attempts .

Its predecessor, Claude Opus 4.6, succeeded twice on the same test. That is a generational jump in autonomous exploit development. OpenAI introduced Aardvark , an autonomous security agent powered by GPT-5 that achieved 92% recall on benchmark repositories seeded with known vulnerabilities, which has since evolved into Codex Security .

OpenAI classified its GPT-5.3-Codex model as " High Cybersecurity Capability " under its Preparedness Framework and has since released GPT-5.4-Cyber , a variant of GPT-5.4 fine-tuned for defensive cybersecurity use cases — including capabilities such as binary reverse engineering — distributed through its expanded Trusted Access for Cyber programme to verified defenders and teams responsible for securing critical software.

Google DeepMind launched CodeMender , an agent that leverages deep-reasoning models to autonomously identify and fix complex vulnerabilities, having already contributed 72 security fixes to open-source projects. The results extend well beyond lab benchmarks. AISLE's autonomous cyber reasoning system discovered 12 of 12 CVEs in the January 2026 OpenSSL coordinated release , plus historical vulnerabilities dating back years, in one of the most heavily audited codebases in existence.

In August 2025, DARPA's AI Cyber Challenge (AIxCC) demonstrated that seven finalist teams could discover 54 vulnerabilities across 54 million lines of code in just four hours, at an average cost of approximately $152 per task, with 18 real vulnerabilities responsibly disclosed. These capabilities are already reaching the market.

XBOW, an autonomous penetration testing platform, reached the number one position on HackerOne's US leaderboard in the first half of 2025 , submitting nearly 1,060 vulnerability reports with 130 confirmed and resolved by programme owners. Aikido Security's AI-powered testing discovered a high-severity cache deception vulnerability affecting SvelteKit applications (a widely used web framework) deployed on Vercel (a major application hosting platform) with default configurations. The trajectory is steep.

CVE-Bench, a benchmark built from real-world critical vulnerabilities ( ICML 2025 spotlight ), initially measured the best autonomous agents at a 13% end-to-end exploitation rate. Less than a year later, OpenAI reported in its GPT-5.3-Codex system card that its latest model reached 90% on the same benchmark.

Even at lower success rates, the economics are decisive: an AI agent that fails most of the time but tries thousands of attack vectors per hour will find more vulnerabilities than a human expert working manually. And the tools are automating the discovery of exactly the kind of vulnerabilities that make up the vast majority of real-world breaches: injection flaws, misconfigurations, authentication weaknesses, and known-but-unpatched issues.

The discovery and exploitation numbers above are real, but they do not tell the whole story. What makes the latest generation of models particularly dangerous is not just the volume of vulnerabilities they find. It is their ability to chain findings across multiple steps, reason about application logic, and produce exploitation paths that previously required deep specialist knowledge. This is what turns a list of individual flaws into a working attack.

For defenders, using these tools responsibly adds friction that attackers do not face. Models can hallucinate vulnerabilities, mischaracterise severity, or propose patches that introduce new issues. Responsible deployment means validating findings, reviewing proposed fixes, and testing patches before they reach production, a workflow that remains labour-intensive even when discovery itself is fast. Running AI-powered analysis at scale also has operational costs.

However, those costs are falling rapidly — each new generation of models has reduced the cost of equivalent analysis by roughly an order of magnitude — which will make systematic scanning more accessible to defenders, and to attackers alike. This creates an uncomfortable asymmetry within the asymmetry: attackers need only one working exploit and face no quality-control burden, while defenders must triage every finding and remediate each one correctly.

The tools are transformative on both sides, but the operational overhead of using them well, rather than merely using them, falls disproportionately on defence. This is precisely why investing in AI-augmented defensive workflows now, before the gap widens further, is so critical. But perhaps the most consequential development is not what the best AI systems can do, but who can now access these capabilities.

Tasks that previously required years of specialised expertise — discovering complex attack vectors, crafting exploit chains…

Related: Google