Vulnerabilities and exploits: where are we headed?

In Are Mythos’ cyber capabilities overhyped?, co-authored with Epoch AI, we looked at the public evidence on how good Mythos Preview was at vulnerability discovery and exploit development. In this post, I consider the implications. For vulnerability discovery: moving from sparse sampling to dense sampling, AI vs fuzzing, long-term defense dominant but bumpy ride in 2026-2027 due to slow patch rollouts; offline vs online exploitation and why both are offense-dominant, except for one defensive use case of exploit development.

AI discovering zero-days will eventually favor defense, but expect a bumpy transition in 2026 and 2027

Long-run dynamics: moving from sparse to dense vulnerability discovery

Vulnerability discovery has always been heavily bottlenecked on labor: critical vulnerabilities remain abundant, because the software attack surface is so large. A mental model I find helpful is that this corresponds to a sparse sampling regime: both defenders and attackers are looking for vulnerabilities independently, each side covering a small amount of the available attack surface. Given that the attacker’s arsenal is the vulnerabilities it has found minus the ones the defender has also found, sparse and independent^¹ sampling implies low overlap, which favors the attacker.

The previous generation of vulnerability discovery automation, fuzzing, turned out to suffer from the same issue, because setting up fuzzing is labor-intensive, and many critical infrastructure codebases have very low fuzzing code coverage on OSS-Fuzz. (Also, network protocols are basically out of reach for fuzzing, as are many classes of vulnerabilities).

Unlike fuzzing, AI vulnerability discovery can be applied broadly and easily (as Project Glasswing demonstrated). This moves the task of vulnerability discovery toward a dense sampling regime for the first time. In the limit where all the vulnerabilities are found by the defenders, attackers will be left with an empty zero-day arsenal.

The effect will become even stronger once we move AI vulnerability discovery earlier in the software lifecycle, before release, such that new code will ship largely free of vulnerabilities (currently, Project Glasswing is finding lots of latent vulnerabilities in already deployed code, and I’ll get back to why this distinction matters).

But are we really going to get to dense vulnerability discovery, or will each generation of frontier models keep discovering more elaborate vulnerabilities?

Both positions are reasonable, but I would estimate that Mythos Preview (plus previous models and other techniques e.g. fuzzing, where they had already been applied) probably found 70-80% of the severe vulnerabilities in the reviewed codebases. Which implies that no future model will ever find as many latent vulnerabilities as Mythos did.

Mythos found thousands of vulnerabilities that previous models had not found, but a lot of it is because previous models had not been given the chance. No one had ever looked at most of these codebases looking for vulnerabilities. In other words, Mythos got to pick a lot of low-hanging fruit. And I would argue that while exploits can get really difficult, vulnerabilities are very often simple to spot when you’re looking for them and happen to be reading the source code where they live. In addition, it seems that severe vulnerabilities tend to be superficial, as suggested by the eyeballvul paper’s results. This includes the injection-type vulnerabilities, most memory corruption issues, basically all of the OWASP Top 10… Exceptions in footnote².

Estimating the number of vulnerabilities that future models may find is obviously difficult, and this is my best guess, but I’d be curious to hear takes from other people in cybersecurity.

Slow patch rollouts and legacy systems will make people acutely vulnerable for a while

AI vulnerability discovery will greatly increase the security of codebases, favoring defense in the long run. However, the transition at the level of the ecosystem and end users will be rough. This is because every latent vulnerability found in already-shipped software gets disclosed, or can be reverse-engineered, at the time the patch is published. Users who don’t apply the patch immediately become vulnerable. In practice, this is a well-known and large-scale problem in cybersecurity.

Sometimes it’s not even up to the users. Current IoT and critical infrastructure devices rarely get updated, if ever. Some of the older ones don’t even support the possibility; some devices with older hardware are no longer supported by the upstream projects; some projects get abandoned despite still running on many systems; upgrades tend to be costly and require ad-hoc processes, and each comes with a real risk of breaking things, as the 2024 Crowdstrike incident showed, and any sysadmin could tell you.

This ride will be made even bumpier by AI exploit development capabilities.

AI writing exploits will mostly favor attackers

Let’s distinguish two types of “exploitation”:

• exploit development (offline): given a known vulnerability, develop a Proof of Concept (PoC) exploit that uses it to achieve some effect (e.g. remote code execution, stealing secrets…)

• hands-on-keyboard intrusions (online): the task of intruding into a live victim environment such as a corporate network.

Exploit generation capabilities were nascent at the beginning of 2026 (e.g. On the Coming Industrialisation of Exploit Generation with LLMs, Jan 2026), and Mythos Preview made a big jump from models basically not really succeeding on real targets, to models being very good at it.

Defensively, this capability will uplift vulnerability validation and triage. Producing PoCs as part of vulnerability reports will clearly demonstrate the true impact of the vulnerability to the project maintainers, and vulnerability validation is a very time-consuming step. This shift to requiring PoCs instead of lengthy vulnerability reports is already underway in the industry (e.g. Evolving the Android & Chrome VRPs for the AI Era, Apr 2026).

Once vulnerabilities are published, the PoC level of detail will also help downstream organizations prioritize responding to the stream of published CVEs. Currently, the number of vulnerabilities published per year is so high (e.g. 48k in 2025) that it’s common for organizations to have backlogs of tens of thousands of vulnerability instances, and to have multi-week mean time to remediation. Vulnerability prioritization is currently very bottlenecked on labor.

Apart from this, AI exploit development will starkly favor attackers, as long as they have good vulnerabilities to exploit. The distinction between “potentially exploitable vulnerability” and “actively exploited vulnerability” will disappear. In 2025, CISA added around 240 KEVs to its catalog. The number of vulnerabilities rated Critical in 2025 was around 4,000. That’s a factor of 17x, which (assuming critical = good and exploitable) is currently mostly thanks to attackers not having enough time to exploit all the vulnerabilities. See also Anthropic’s recent Measuring LLMs’ impact on N-day exploits.

Hands-on-keyboard intrusions is another labor-bottlenecked area where we are seeing fast progress. This is strongly offense-dominant, and especially concerning for the long tail of low and medium-value targets, which were previously protected by the fact that they were not worth the attackers’ time, despite weak defenses. Or more specifically, they may have been worth the attackers’ time (their value was higher than their exploitation cost), but attackers being bottlenecked on labor means that they had to focus on the highest-returns targets.

Cheap and capable AI agents can be embedded in malware to increase its deployment reach, for instance by dealing with the diversity of user configurations (something starting to be observed in the wild). The end product won’t look like this proof of concept: it will look like the malware being a competent and patient operator. This can make propagation extremely effective (via e.g. tailored emails or messages sent to the address book), and increase the value of targets (compared to traditional mass-scale malware) via, generally speaking, targeted attacks. LLMs unlock new paths to monetizing exploits has a list, but I trust cybercriminals to come up with many inventive new ways to make money off victims, in addition to upgrading the existing ones.

I think that AI intrusions will be a big deal, and perhaps increase the (already substantial) cost of cybercrime on vulnerable people by 1+ OOM, despite defenses. While offline exploit development will eventually be mitigated by vulnerabilities drying up, AI intrusions may remain a big problem for a long time.

In the interest of getting this post out, I’m leaving defenses (the ones that exist, and don’t yet exist) for future blog posts.

As always, I’m very interested in feedback. See my contact info.

Thanks to JS Denain, Alexander Barry, and Anson Ho for reviewing an earlier version of this post.

1. In the sparse sampling model, it’s interesting to think about how correlated the attacker and the defender are. It’s hard to say for humans in general. For fuzzing, they are highly correlated provided the same fuzzing harnesses, but attackers focus on parts of codebases that are known not to be fuzzed (e.g. OSS-Fuzz gives reports on this, and for closed-source codebases, a given part of a binary is overwhelmingly likely not to be fuzzed) in order to anti-correlate their results. Intuitively, attackers and defenders reviewing the same codebase with the same AI model would probably be quite correlated, which is good for defense.

2. I think exceptions are mostly UAF, race conditions (James Kettle in the Smashing the state machine blog post: “in my experience it’s extremely challenging to identify race conditions through pure code analysis”), and crypto protocol weaknesses. The last one is the one where I’m most unsure about how far the ceiling is.