AI turned exploits from weeks to hours

a16z Blog says the bottleneck that kept most bugs unexploited for 23 years has collapsed, and AI agents now turn a patch into a working exploit in hours.

The piece, by Asaf Ezra and Steph Zhang, frames the shift through field cases from August to October. A single operator pointed a few hundred agents at a print-management server used by schools and offices. The agents built a lab, wrote exploits for two bugs disclosed four days earlier, and went from empty workspace to first real break-in in under four hours. Eleven organizations fell in 26 seconds the next morning. GreyNoise counted 395 compromises in 48 countries, half in schools.

The model was a cheap open-weight system, not a frontier lab model, and it required only remote network access. Amazon saw the same compression with PHP, the language behind about 70% of websites. Exploit attempts hit its decoy servers four days before disclosure and 12 hours before the fix, with working shells in three days. CJ Moses, Amazon CISO, said AI "makes it cheaper to turn a patch diff or advisory into a working exploit" and that "a 7-day or 30-day SLA assumes a delay that no longer exists."

That is the why now. Mandiant data cited in the analysis shows average time from disclosure to attack falling from 63 days in 2018-19 to 44 in 2020-21, 32 in 2021-22 and five in 2023, then to one day before disclosure in 2024 and seven days before in 2025. The lines crossed before agentic AI, driven by state groups and ransomware crews hitting internet-facing appliances. The analysis argues AI widens who can operate in that window and how fast known bugs get weaponized.

For two decades building an exploit was expensive. RAND found a median 22 days for a professional to build a working zero-day in a 2017 study of more than 200 cases, per the analysis. Brokers paid thousands to millions per exploit. That cost helps explain why only about six percent of published vulnerabilities had ever been seen exploited in the wild. Metasploit made reuse cheap, but someone still had to write the exploit and run it.

Anthropic lab runs cited in the piece quantify the drop. In March 2026 several hundred attempts and about $4,000 produced two working Firefox exploits with its then-current model, per the analysis. A month later its next model, kept off general release, produced 181 on the same task. By June the lab reported going from a released Firefox patch to a working exploit in under an hour, and from Windows kernel binaries with no source to eight privilege-escalation chains in 18 hours at about $2,000 each. Independent tests point the same way, with the UK AI Security Institute finding the length of cyber tasks models finish unaided doubling every 4.7 months.

Open-weight capability is close behind. An open-weight model reliably exploited the patch gap to compromise six recent Firefox releases at about $1,000 each, and Z.ai's GLM 5.3 released in August can identify and exploit vulnerabilities in similar settings, according to Epoch AI. That matters because open-weight models typically trail frontier models by months to a year, and thousands of versions with safety training stripped are already hosted publicly.

Patching has not moved. Qualys measured the half-life of a critical vulnerability at 30 days in 2003 and the same in 2008, per the analysis. Verizon's 2026 Data Breach Investigations Report puts median time to fully fix a known-exploited vulnerability at 43 days, up from 32 a year earlier, with only 26 percent fully fixed within the year. A quarter of 2025 industrial-control advisories shipped with no patch at all. Grid operators are allowed 35 days to evaluate a patch and 35 more to apply it. In October, an unreleased Anthropic model exploited a Linux kernel multipath TCP bug fixed upstream on October 5 in under an hour with remote, no-login access, per the analysis. More than three weeks later Ubuntu and Red Hat still had no fixed package.

The analysis does not predict a bulk grid blackout. Turning off power takes more than access. Protection equipment acts on physics, restoration is practiced, and every successful grid attack on record took a state team months and restored in hours, it notes. The harder risk is small operators with exposed controls. Intruders used AI-generated scripts against Siemens controllers in energy, water and chemical plants with no new vulnerabilities, per an August advisory from NSA, CISA, FBI, Energy and EPA. Dragos documented a frontier model as primary executor building a 17,000-line framework to the edge of a Mexican water utility's control network.

Recent field points are specific and limited. On September 21 an agent chained two zero-days in a help-desk product to break into the Dutch Institute for Vulnerability Disclosure in seconds, deciding the next step itself, per DIVD. In May Google assessed AI developed a criminal zero-day before use. The PHP scare shows the counterweight too. Millions of attempts produced few confirmed compromises, as memory-corruption bugs are hard to weaponize reliably and hosting platforms blocked attacks at the edge within a day. But 2.6 to 4.4 million internet-facing PHP installs remain, about 80 percent on unsupported versions.

The next test is the pending distribution fixes for that Linux kernel bug and the winter patch cycle for long-tail PHP installs, both still rolling out as of late October.