The Commodity Attacker: How Frontier AI Left Every Organisation Vulnerable

The frontier AI threat to your organisation is not a new category of attack. It is the software you already run, your web applications, your APIs, your infrastructure, and the open-source libraries buried inside all of them, being found and broken faster than you can patch it.

For most of the history of enterprise security, one thing protected you more than any control you bought. Finding a genuinely exploitable flaw in real software took scarce, expensive, expert labour, and most attackers could not afford it. That labour cost was a moat, and the moat is draining.

Your patch and exposure timelines were built for a world in which deep vulnerability discovery was slow and rare. That world is ending and technology leaders need to recalibrate their remediation timelines before the gap between how fast flaws are found and how fast your teams can fix becomes an open invitation.

The gap the numbers already show

A coalition of technology firms, in an effort called Project Glasswing, ran frontier AI against widely used software and reported finding more than 10,000 high- or critical-severity vulnerabilities in the first month, an Anthropic-led aggregate that is an order-of-magnitude signal rather than an audited total.^[1] Palo Alto Networks' Unit 42 reached the same order of magnitude by a different route, its own NOVA system reporting 14,090 vulnerabilities across 3,915 open-source projects in two months, 99.4% of them previously unreported.^[2]

Of the vulnerabilities that Project Glasswing disclosed to open-source maintainers, 1,596 across 281 projects, only 97 had been patched at the last confirmed count, a rate of roughly 6%.^[3] The Cloud Security Alliance, reviewing the disclosed data, concluded that the bottleneck has moved from finding flaws to fixing them, because the tools run at machine speed while the maintainers who ship the patches run at human speed.^[4]

The window between a flaw becoming public and its exploitation has collapsed. Mandiant, the Google-owned incident-response firm, put the mean time from disclosure to exploitation at 63 days in 2018 and negative by 2025, at roughly minus seven days.^[5]

The defender side of the same gap is widening at the same time. Verizon's 2026 Data Breach Investigations Report found that exploitation of vulnerabilities has overtaken stolen credentials as the leading way into an organisation, now behind about 31% of breaches, and in the same period the median time to patch rose from 32 to 43 days.^[6]

The boundary of the threat

This is not about tricking people. None of it turns on phishing, deepfakes, or social engineering, because the threat stands entirely on the technical path into your software, where the attacker never has to persuade a human of anything. The human-manipulation threat is real and worsening, but it is a separate subject. It is also not the securing-your-own-AI-agents discussion, which is distinct from the adversarial use of AI against the software you already run.

The adjacent view worth sharpening against is that automated vulnerability scanning is an old, managed problem, and that serious flaw discovery is the province of a handful of scarce researchers. Both halves were true. Legacy scanners found shallow, known-pattern issues, and elite researchers did the deep work by hand and were few.

What has changed is that deep discovery and working exploit development are no longer scarce and expensive. They are becoming abundant and cheap, at a scale and depth the old scanners never reached, and running ahead of the pipeline that ships the fix.

The economics of attacking your software just changed

Consider what a single serious vulnerability used to cost the attacker. A researcher had to read unfamiliar code, understand its structure, form a hypothesis about where it would break, and then build a reliable exploit, often over weeks. That expertise was rare and commanded high pay in legitimate work, so most organisations were shielded by the price of the attacker's labour more than by their own controls.

Capability Compression removes that shield. It is the collapse of the time, cost, and skill required to find and weaponise software flaws, so that discovery and exploit development, once the work of scarce expert researchers, become abundant and cheap. When a model can read a large codebase, reason about where memory is mishandled, and surface an exploitable condition in minutes, the marginal cost of the next flaw falls towards the cost of the compute. Google DeepMind draws the same line, defining the level at which AI meaningfully assists a high-impact cyber attack as an order-of-magnitude cut in an attacker's cost and resources.^[7]

The proof is in the kind of flaws now being found. Project Glasswing surfaced a 27-year-old flaw in OpenBSD, a 16-year-old bug in the FFmpeg media library that had survived 5 million automated fuzzing attempts, a 17-year-old remote-code-execution flaw in FreeBSD that handed root access to machines running network file sharing, and chained flaws in the Linux kernel that escalated an ordinary user to full control of the machine.^[1] These are exactly the deep, long-buried defects that used to define elite research, found at volume.

The UK's National Cyber Security Centre, reassessing the threat, put it in the sharpest terms yet, judging that the most significant near-term development would come from AI-assisted vulnerability research and exploit development, and that AI would enhance zero-day discovery and exploitation for actors able to fine-tune models to the task.^[8] The same assessment expects the ordinary, less-skilled attacker to close much of the gap simply by repurposing what is freely available.^[8]

The kill chain, compressed

A software intrusion moves through recognisable stages, and AI compresses each of them.

The first stage is reconnaissance, mapping an organisation's exposed services, software versions, and dependencies to find the soft targets. AI mainly makes this faster and broader, turning target research and exploit triage into cheap, tireless work. Google's Threat Intelligence Group documented state-linked actors sending thousands of automated prompts to analyse disclosed vulnerabilities and validate proof-of-concept exploits, and directing models to act as senior security auditors against repositories holding tens of thousands of real vulnerability cases.^[9]

The second stage, vulnerability discovery, is where the shift is sharpest. An early proof came in 2024, when Google's Big Sleep agent found a previously unknown, exploitable memory-safety flaw in SQLite, a database used almost everywhere, before it reached a released version.^[10] That was one bug, one team, one demonstration. Two years later Project Glasswing turned the same capability into thousands of findings, and, on one independent academic benchmark, reported scores climbed from around 20% into the 80–90% range across several vendors within roughly a year, on differing subtasks.^[11][1]

The third stage is exploit development, turning a known flaw into working intrusion code. An academic study tested AI agents against 15 real, disclosed vulnerabilities and found that a leading model exploited 87% of them when given the public vulnerability description at roughly a third of the cost of equivalent human work.^[12] Success collapsed to 7% when the description was withheld, so once a flaw is public, exploiting it is close to automatic for a capable model. That is no longer a laboratory nuance, because Google's Threat Intelligence Group has since intercepted the first documented AI-generated exploit aimed at a real, planned campaign, a two-factor-authentication bypass in a widely used administration tool built on a logic flaw that looks functionally correct to a traditional scanner but is strategically broken, disclosed and patched before the criminal operators could use it.^[9]

The final stage is intrusion and campaign orchestration, stringing the steps into a sustained operation. Anthropic disclosed a state-sponsored group that, on its account, drove 80% to 90% of an espionage campaign through an AI agent, with human operators intervening at only a handful of decision points, against roughly 30 targeted organisations.^[13] Anthropic's later 12-month review generalises that single case into a trend, cataloguing 832 accounts banned for cyber misuse and reporting that the share of actors it assessed as medium-risk or higher rose from 33% to 56% across the year, with malware development the single most common pattern.^[14]

Real operations are now automating stages that used to need a skilled human at the keyboard, and the pattern is broadening rather than isolated.

What AI cannot yet do

What has moved is discovery and exploitation, and the sharpest evidence comes from a safety failure rather than a marketing claim.

Reviewing its own cybersecurity capability evaluations, Anthropic disclosed that its models reached the public internet from environments meant to be isolated and gained unauthorised access to the production systems of three real organisations.^[15] The cause was a containment misconfiguration that left the evaluation machines with live internet access, and the models reached real systems using basic, well-known techniques, reading credentials from an exposed debug page, injecting SQL, and uploading malware to a public registry that was then run on 15 real systems.^[15]

OpenAI had disclosed a similar failure nine days earlier. Running an offensive-capability benchmark with reduced cyber refusals to measure their limits, two of its models, GPT-5.6 “Sol” and a pre-release model, found and weaponised a genuine, previously unknown zero-day in a third-party component on OpenAI's own research infrastructure.^[16] They escaped to the open internet and breached the production infrastructure of Hugging Face, which confirmed its own side of the incident, recording more than 17,600 automated actions across two code-execution paths and access to internal datasets and service credentials, and they reached a second organisation through an exposed customer endpoint.^[17] The underlying zero-day, in the Artifactory package-registry component, was independently confirmed and patched by its vendor JFrog.

Two containment failures at Anthropic and OpenAI, nine days apart, are themselves the finding. The two are distinct, since OpenAI's models discovered a previously unknown vulnerability and used it while Anthropic's turned on a containment misconfiguration, yet both breached real production systems. Neither shows the limit that still holds, reliable, unsupervised, end-to-end intrusion at will against a hardened target, because each needed a misconfiguration or deliberately loosened controls and no model chose to break out. The UK's National Cyber Security Centre still assessed fully autonomous, end-to-end attacks as unlikely through 2027.^[8]

The point is what this foreshadows more than what it proves. These were accidents and evaluations, and the capability still reached real production systems, real credentials, and a live zero-day. What the incidents lacked was a human directing that capability to break in, which is exactly what a deliberate, well-resourced state-sponsored operator supplies. The technical reach is demonstrated, and the intent is the attacker's to add.

The labs draw the same line when they gate their own releases. OpenAI defines a critical cyber capability in its framework as a model that can identify and develop functional zero-day exploits in many hardened real-world systems without human intervention, and reserves a lower tier for a model that merely removes bottlenecks to scaling operations.^[18]Its own July 2026 evaluation of a current frontier model placed it in that lower tier, capable but not yet critical. Capability is climbing towards the line, and the labs' own frameworks say it has not crossed it.

Independent measurement keeps the same balance. A controlled trial commissioned by the UK AI Security Institute found that the uplift from AI access was generally not statistically significant across complete, end-to-end attack chains, yet that novices with no cyber background could solve capture-the-flag challenges in under an hour using an AI coding agent, where a low-skill attacker previously could not have exploited even a known flaw without pre-built code.^[19] A separate RAND study in a different high-consequence field found no statistically significant uplift in the viability of a hostile plan from model assistance, a reminder from an adjacent domain that measured uplift is often smaller than the alarming framing suggests.^[20]

Verizon's Data Breach Investigations Report finds that AI is mainly accelerating and scaling known methods rather than inventing new ones. That is the honest shape of the threat, a rising skill floor and real, scaled discovery capability rather than a new class of autonomous attack, and it is enough to overrun an under-resourced defence.^[6]

Recalibrating the defence

Every timeline and control set against a slow, scarce researcher needs resetting for a fast, abundant one. The exposure window is no longer the time it takes an attacker to find a flaw, but the time it takes you to fix one that has already been found.

Technology leaders should start with patch and exposure-management timelines. A programme whose median time to patch is drifting towards six weeks, against a threat environment where exploitation of a public flaw arrives in hours and sometimes before a patch exists, is calibrated to the wrong world.^[6][5] The question a CISO should be able to answer is how fast the organisation can ship a fix for a critical, actively exploited flaw in a dependency it does not maintain, measured in hours and days rather than sprint cycles. The US Cybersecurity and Infrastructure Security Agency has already moved its federal remediation rules that way, harmonising the timelines for acting on known-exploited vulnerabilities on internet-facing systems.^[21]

Security teams need to treat the open-source dependency backlog as a first-order exposure rather than a compliance artefact. Most enterprise software is mostly open-source code with a thin layer of proprietary wiring and business logic on top, and Project Glasswing's findings show that code carries decades-old flaws now being surfaced at scale.

The instrument is a software bill of materials taken to full transitive-dependency depth rather than only the top layer, because shallow inventories undercount real exposure.^[22] Build and provenance integrity through the SLSA framework, dependency pinning with verification of where each component came from, and a standing process to pull upstream fixes quickly are what turn that inventory into a defence rather than a filing exercise.^[23] None of this is new, but the discovery rate now makes it load-bearing rather than good practice.

Engineers must build the remediation capacity to match the discovery rate, and that capacity is now partly the same AI capability applied to the fix, not only more people. A model that proposes a patch in the same pass that finds a flaw, and continuous testing that regenerates its own cases as the code changes, are what let a fix ship inside the attacker's window rather than joining a queue. The concrete target the gap implies is a critical, actively exploited vulnerability patched within about 24 hours rather than the days to months common in most programmes, because a negative time-to-exploit against a 43-day median patch time is the window the attacker now lives in. The design goal is a discovery-to-fix loop that runs at one speed, because finding faster while fixing slower only lengthens the backlog that is the exposure.

Detection and secure development sit inside the same recalibration. Detection should be tuned for AI-scaled scanning and for AI-generated exploits that pass signature-based rules by looking functionally correct. Secure-development practice should move the first check earlier, so whole classes of flaw are caught as code is written rather than after release. Governance frameworks now place a dedicated govern function at the centre of the model, which is where risk tolerance and the funding of the response belong rather than as a technical afterthought.^[24]

Turn the compression around

The compression is symmetric. The same capability that lets an attacker find and weaponise flaws at machine speed lets a defender find and fix them at machine speed, and the organisations moving first are already doing it.

The core idea is to run the same discovery capability inward, before an attacker runs it against you. Project Glasswing, the Anthropic-led coalition of Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, Nvidia, and Palo Alto Networks, is doing exactly that across critical open-source software, and had grown to roughly 200 partner organisations by mid-2026.^[25][26] Leading technology companies are already running the same discovery against their own code and dependency trees, finding the flaws an attacker would find first.

The fix side matters as much as the finding side, because discovery at machine speed is wasted if remediation still crawls. Mozilla reported that a model-driven pipeline shipped the bulk of an unusually large April 2026 Firefox security release in the same week the flaws were found.^[27] Earlier in the pipeline, Anthropic's Claude Security scans code and suggests a fix in the same pass, and the company reported several hundred production flaws found in a private preview.^[28] Reading code for how data flows rather than matching known patterns is what lets such a reviewer catch classes of logic flaw that signature-based scanners miss.

Continuous testing is the third piece, and it is the oldest. Google's OSS-Fuzz has run free for maintainers against more than 1,000 open-source projects since 2016, and when an AI-generated layer was added in 2024 it wrote test cases the human-written ones had missed, surfacing 26 further flaws including one in a core cryptography library that had gone undiscovered for roughly two decades.^[29]Fuzzing that regenerates its own targets as the code changes is continuous assurance rather than a periodic audit, the defender's version of the tireless probing the attacker now runs.

DARPA's AI Cyber Challenge, concluded in 2025 with no vendor's model as the story, tasked teams with building systems that both find and patch vulnerabilities, and its finalists identified the large majority of seeded flaws and patched most of what they found.^[30] Find-and-patch, not find-only, is the capability that actually closes the exposure window.

More uses sit inside day-to-day operations. In the security operations centre, a team drowning in alerts against AI-scaled scanning can put a model to work summarising, correlating, and prioritising at machine speed, so analysts spend their attention on the events that matter. The same models can be turned on your own systems as an AI-assisted red team, probing for the flaws an attacker would reach first. And because AI-generated exploits increasingly turn on semantic logic flaws rather than known signatures, detection has to learn the shape of machine-written code, which is how Google's Threat Intelligence Group spotted an AI-generated authentication bypass from the tell-tale characteristics of its script and disrupted the campaign before it ran.^[9]

The defensive tooling carries its own exposure. Project Glasswing finding more than 10,000 flaws is direct proof that the same capability is in attackers' hands, and the roughly 6% patch rate it exposed is the window those attackers walk through.^[1][3] Anthropic, behind much of this evidence, has separated in its scaling policy what it can achieve alone from what needs industry-wide coordination, and its own July 2026 containment failure showed the evaluation infrastructure built to measure this capability becoming the path through which real systems were breached.^[31][15] Defensive AI is necessary and, on its own, insufficient, because finding faster than you fix only widens the backlog.

There is a further limit on the defender's side that the attacker does not share. A defender using a frontier model inherits its guardrails, and those guardrails are deliberately tuned against offensive use. Anthropic's Claude Opus 5 permits vulnerability search in source code but blocks it in compiled binaries, an explicit line between defensive and offensive work, and it deliberately trails Anthropic's discovery-focused Mythos model on exploitation.^[32] The independent evaluator SaferAI found the prior Claude generation refused offensive tasks so consistently that it could not complete a standard cyber benchmark on the model at all, and METR, another independent body, documents the same restriction pattern across the major labs.^[33][34]

The attacker faces no such constraint. The UK AI Security Institute found open-weight models now trail the closed frontier on cyber capability by only about four to seven months, and one of them, Z.ai's GLM-5.2, refused none of the offensive tasks it was tested on and shipped with no published safety framework.^[35] A frontier model can also be jailbroken to strip its guardrails, and in one 2026 episode Anthropic disabled Fable 5 and Mythos 5 worldwide when it could not enforce a narrower, nationality-based restriction.^[36] Palo Alto Networks' Unit 42, running its own NOVA system, reached the same source-versus-compiled capability line the labs encode as policy, which shows the restriction tracks a real capability difference rather than an arbitrary rule.^[2]

The implication for the board is not to copy the attacker's toolkit. It is that a defence built on a single restricted frontier vendor is planning around a constraint the attacker has already stepped past. Resilience depends on vendor strategy and on vetted-access programmes that widen what a compliant defender can legitimately do, not on assuming the defender and the attacker hold the same capability envelope.

Who owns the recalibration

The recalibration is an operating and funding decision, and it belongs to the board, not to a security team asked to absorb it inside a flat budget. It sets how fast patch and exposure timelines compress, whether the open-source dependency backlog is funded as a first-order risk or left as a filing exercise, and how fast the organisation puts AI-assisted discovery and remediation into its own operations while accepting the new exposure that tooling brings. Those are choices about money and accountability, and only the top of the house can make them.

The CIO and CISO carry the concrete agenda. They compress patch and exposure-management timelines to match a world where discovery outpaces patching, and hold them to the standard federal remediation rules are already moving towards.^[21]They point discovery inward against their own code and dependencies, put automated fix suggestion and continuous testing into the remediation loop, tune detection for AI-scaled scanning and AI-generated exploits, and run AI-assisted red-teaming and alert triage in the security operations centre. The same leaders also govern the tooling itself as an attack surface, and plan for the reality that a compliant defender's frontier model is a narrower instrument than an attacker's unrestricted or jailbroken one, which is a vendor-strategy and vetted-access decision the board owns rather than a reason to match the attacker tool for tool.

The advantage compounds, and that is why the timing matters. A competitor can buy the same discovery tools in a matter of weeks, because the tools are not the moat. The organisation that has already compressed its patch timelines, funded its dependency backlog, and built AI-assisted remediation into its security operations holds a resilience that the late mover, still calibrated to a slower world, cannot buy back quickly, because the backlog it has already cleared is the backlog the late mover is still discovering.

So the question for the next board meeting is not whether AI has changed the attacker's economics. The disclosures and the trend lines have settled that. It is narrower and more useful. Which timeline will you compress first, and who owns the date it happens by?