# Exploits now beat patches by 70 days _Chainguard's Patrick Smyth told AI Engineer that exploits now beat patches by 70 days, blaming frontier agents for faster chaining and supply chain worms._ **Published:** 2026-10-28 **Source:** https://www.startuphub.ai/ai-news/technology/2026/exploits-now-beat-patches-by-70-days --- Patrick Smyth, who works on software supply chain security at Chainguard, told [AI Engineer](https://www.youtube.com/watch?v=xZX3pmaB8Hk) that exploits now land on average 70 days before patches, reversing a 63-day patch lead from 2018 and 2019. The claim is dramatic, and the math is noisy. Smyth credited the figure to Mandiant’s MTrends report and argued frontier agents let a solo operator work like a team and a team work like an advanced persistent threat, chaining small bugs into working exploits. He pointed to JavaScript and Python registries, CI/CD pipelines, developer laptops and emerging agent skills as the soft targets, citing the Shai Hulud worm and a two-hour compromise of axios that still reached about 600,000 downloads. Smyth pitched Chainguard’s answer as Wolfi-based containers rebuilt one to four times daily with a one-day fix for exploited flaws, libraries built from source outside PyPI and NPM, and a gated Athena consortium for zero-days that he described but did not price or open, a posture Chainguard frames on its site as providing trusted artifacts for containers, libraries and VM images. He never answered how many of those negative-70-day exploits were frontier-model found zero-days versus n-day reuse, or whether a 24-hour SLA holds when the compromise starts on a maintainer’s laptop before the package even publishes. --- Original analysis from [startuphub.ai](https://www.startuphub.ai), the #1 AI startup directory. © StartupHub.ai. All rights reserved. You may not republish this article in full without a license. Search engines and AI research tools may crawl and summarize for reference. Bulk reproduction or model training on this content requires a license. See https://www.startuphub.ai/terms.