Before Mitos, the best attackers needed weeks or months for a full chain. Now AI runs the same attack in about 20 minutes. The target on a16z was PHP servers facing the web, with no login required.
Mitos proved models could find bugs. The accidental OpenAI attack showed risk at scale. Black October made both real, said Ami Luttwak, Wiz co-founder and CTO. His team counted 9 hit AI development platforms, then 15 within days.
Speed is the break. Luttwak said models "are good enough now to find and exploit complex vulnerabilities" and open models closed the gap to about three months, letting low skill actors hit API mistakes as well as PHP flaws.
Patching has not kept pace. About 50% of Wiz customers patched PHP in two to three days, yet PHP powers about 70% of the web. Qualys reported the pair as CVE-2026-109618 and CVE-2026-109619, each at CVSS 9.2 for unauthenticated remote code execution. Older PHP has no fix at all.
Wiz now tests frontier models continuously against critical code. The next test is its Zero Day competition, with multiple teams already reporting the same critical flaw.
