Patrick Smyth, who works on software supply chain security at Chainguard, told AI Engineer that exploits now land on average 70 days before patches, reversing a 63-day patch lead from 2018 and 2019.
The claim is dramatic, and the math is noisy.
Smyth credited the figure to Mandiant’s MTrends report and argued frontier agents let a solo operator work like a team and a team work like an advanced persistent threat, chaining small bugs into working exploits.
He pointed to JavaScript and Python registries, CI/CD pipelines, developer laptops and emerging agent skills as the soft targets, citing the Shai Hulud worm and a two-hour compromise of axios that still reached about 600,000 downloads.
Smyth pitched Chainguard’s answer as Wolfi-based containers rebuilt one to four times daily with a one-day fix for exploited flaws, libraries built from source outside PyPI and NPM, and a gated Athena consortium for zero-days that he described but did not price or open, a posture Chainguard frames on its site as providing trusted artifacts for containers, libraries and VM images.
He never answered how many of those negative-70-day exploits were frontier-model found zero-days versus n-day reuse, or whether a 24-hour SLA holds when the compromise starts on a maintainer’s laptop before the package even publishes.
