Zero-days found by AI systems: what the labs reported and what it costs

Since 2024, artificial intelligence (AI) systems built or run by Google, OpenAI, Anthropic, Microsoft, Chinese labs, security startups and university teams have found hundreds of previously unknown vulnerabilities in software almost everyone runs: SQLite, FFmpeg, OpenSSL, Chrome, Firefox, the Linux, FreeBSD and OpenBSD kernels, Windows and curl. Most of the bugs with public identifiers are memory-safety bugs in old C and C++ code. Most of those listed here are patched, but the largest programs report far more finds than fixes. The slow part of security work has moved from finding bugs to checking and fixing them, and that changes what defenders should do.

First principles

A zero-day is a vulnerability the maintainers do not know about, so no fix exists when it is found. A bug the vendor already had from another reporter is a duplicate, not a zero-day.

Finding one has always been expensive because it takes three kinds of work.

1. Reading code paths. Follow untrusted input through code that may be decades old and very large, and spot where an assumption breaks.
2. Reaching the bug. Build an input that passes every earlier check and arrives at the faulty line in the bad state. Fuzzers do this by volume, humans by reasoning.
3. Triage. Reproduce each candidate, check whether an attacker can reach it, rate it, deduplicate it and write it up so a maintainer acts.

Models now do the first step well, because reading is cheap for them and runs in parallel. Anthropic, for example, ranks a project’s files by how likely they are to hold bugs and gives each agent a different file. Models are also good at variant analysis, which means taking a known fix and asking where else the same mistake appears, and at writing harnesses that reach a suspect line. Google’s OpenSSL find came from a large language model (LLM) writing fuzz targets, not from the model spotting the bug itself.

They still do triage badly on their own. In Sean Heelan’s larger test of OpenAI o3 on Linux kernel code, about one report in 50 was real, and Microsoft found that three of its tool’s top five findings in one bootloader filesystem parser were false positives. The precise systems put a check outside the model: a crash under a memory sanitizer, a validator that runs a real payload, or a human reviewer. Models are also poor at knowing whether a bug is new, so many reports turn out to be duplicates.

Most finds land in memory-unsafe C and C++ for mechanical reasons. In a memory-safe language an indexing mistake raises an error. In C and C++ it writes to the wrong memory, which an attacker can often turn into code execution. These languages also hold the oldest code that parses untrusted bytes: media decoders, kernels, browser engines and cryptographic libraries. And a memory bug comes with an objective test: if a crafted input crashes the program under a sanitizer, the bug is real. That makes this class the easiest for an agent to prove without a human.

What the labs found

Identifiers are Common Vulnerabilities and Exposures (CVE) numbers where one exists.

Google

Big Sleep is an agent from Google Project Zero and Google DeepMind. A human expert reviews each report before filing.

Big Sleep also reported bugs in QuickJS, Apple WebKit, curl, ImageMagick, libxslt and cups-filters. The CVE-2025-6965 record credits a Google researcher assisted by Big Sleep, and Google’s statement that the find stopped planned exploitation names no actor.

OpenAI

OpenAI’s agent, first called Aardvark, is now Codex Security. Partners such as Trail of Bits and Calif use its GPT-5.5-Cyber and GPT-5.6-Cyber models.

OpenAI-credited fixes also shipped in GnuPG, Apache httpd and the Brotli decoder. Credit is often indirect: GnuTLS credits the OpenAI Security Research Team and never mentions AI, and OpenAI tied the bugs to Codex Security months later.

Anthropic

Anthropic’s Frontier Red Team, its staff and partners such as Calif ran Claude Opus 4.6 and the restricted Claude Mythos Preview under Project Glasswing and a coordinated vulnerability disclosure (CVD) program.

Claude is also credited on Windows and Apache fixes. Mozilla separately used Mythos Preview on Firefox and shipped fixes for 271 bugs in Firefox 150. Its advisory lists no matching individual CVEs, only three roll-up memory-safety CVEs credited to Mozilla staff.

Microsoft

Microsoft’s Autonomous Code Security team built a multi-model agentic scanning harness (MDASH), used by its Frontier Offensive Research and Generative Exploitation (FORGE) Lab.

Microsoft’s open-source finds, including two Low curl flaws (CVE-2026-9545 and CVE-2026-13608), carry AI credit only in the FORGE post, not in the CVE records.

Other labs and public bodies

Tencent’s labs also found a ClamAV overflow and a Linux vhost guest escape.

Startups

Startups also reported a CPython use-after-free, a WeChat zero-click worm and an OpenSSL stack overflow.

AIxCC and university teams

The Defense Advanced Research Projects Agency (DARPA) ran the Artificial Intelligence Cyber Challenge (AIxCC), where finalist systems hunted planted bugs in real projects and also found real ones.

Patterns

Memory safety leads. By our count, about 30 of the 43 rows above are memory-safety bugs: out-of-bounds reads and writes, use-after-free, double free, and the integer overflows behind them, nearly all in C or C++. Most of the rest are authentication, authorization, certificate or configuration flaws, where nothing crashes.

The code is old, parses untrusted input and was already fuzzed. Finders report ages of 13 to 27 years for bugs in OpenSSL, OpenBSD, FreeBSD, Linux, Chrome and curl. 150 hours of processor time spent on conventional fuzzing missed Big Sleep’s SQLite bug. Such bugs need a precisely structured input or a rare state, which a model can reason towards and a random mutator rarely hits.

Variant analysis works. Big Sleep’s SQLite find started from a recent commit, Anthropic’s Ghostscript bug from git history, and Microsoft’s bootloader work found the same symlink overflow copied across three projects. Calif turned its first PHP finding into an instruction file for hunting variants.

Logic bugs appear where they can be checked. In 2026 more finds were cryptographic or authorization logic: certificate and signature checks in wolfSSL, Botan and Bouncy Castle, Artifactory, Google’s XSS bugs. PageBreak shows why: a validator that is not AI-written runs a real payload on each finding, giving logic bugs the objective test sanitizers give memory bugs.

Finders converge. Calif and OpenAI independently reported the root cause of PHP2Shell, and Wiz reported further attack paths. Five parties share credit for nginx CVE-2026-42055, and AI-credited Apple fixes often list several reporters. Redis said the three publicly described Kimi K3 bugs were already in its bounty queue. If several labs find a bug within weeks, assume attackers can too.

Exploitation is rare but predictable. Most AI-found bugs have not been exploited (figures below). Those that were: BeyondTrust remote access without login; Ghost’s SQL injection, the only exploited one among 225 Anthropic-linked CVEs; Copy Fail local root, added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog; Artifactory CVE-2026-42016 in a chained attack; and PHP2Shell, where Amazon saw an attempt before disclosure. The Google Threat Intelligence Group (GTIG) also reported a criminal group it believes used AI to find and weaponize a two-factor authentication bypass.

Attribution is messy. The CVE format has no field for AI discovery. Records name a model, a person working with Claude, or only a company, so counts of AI-found CVEs depend on parsing free text.

The cost side

False positives fall when proof is required. SQLite’s CVE page marks six 2026 CVEs as apparent AI hallucinations, with no finder named. Daniel Stenberg said a Mythos scan of curl listed five confirmed vulnerabilities, of which one held up. Chromium’s guidance on AI-generated reports explains why some are invalid. In October, Google stopped accepting product reports to its open-source reward program, citing a rise in automated submissions it said were mostly invalid, and by April HackerOne’s Internet Bug Bounty had paused submissions.

The larger cost is valid volume. Greg Kroah-Hartman said kernel reports turned from slop to real around February 2026. By May, Linus Torvalds said duplicate AI reports had made the security list close to unmanageable, and the kernel now treats AI-found bugs as public. curl ended its bounty in January, paused intake from July 1 to August 3, and from October 26 handles Low and Medium reports in public. Stenberg’s reason: “We must act to survive” (curl blog). Microsoft’s FORGE Lab says the bottleneck has moved from discovery to deciding which reports are real, reachable and security-relevant.

Patches lag finds. Georgia Tech’s AIxCC systematization of knowledge (SoK) paper found that 38 to 46 percent of patches from two baseline AI agents had semantic errors that only manual review caught, and an Open Source Security Foundation (OpenSSF) review of 630 patches found 20 to 40 percent wrong despite passing tests.

Disputes. FFmpeg objected to Google filing AI-found bugs with disclosure deadlines without sending patches. Michael Niedermayer, its main security fixer, said he had fixed most of the Big Sleep issues and called Google helpful. A critic questioned how Mozilla’s 271 Mythos finds reconcile with its advisories before accepting that roll-up CVEs could explain the count, Bruce Schneier questioned the low patch rate, and Help Net Security reported that, as of May 22, most Mythos Preview candidates had not been reviewed by anyone outside Anthropic. Redis said the Kimi K3 bugs it could see duplicated earlier reports and that it had no details on the rest. TechTimes reports that Chinese rules require new bugs to reach a ministry within 48 hours, possibly before vendors hear.

The other side. A write-up of a talk by Google’s Heather Adkins says all but five Big Sleep finds had been fixed at the time. Stenberg now says slop has nearly vanished, and in 2025 he wrote that a new breed of AI analyzers saw patterns older tools had missed. Maintainers of the CUPS printing system welcomed AIxCC reports that came with patches. The labs also fund maintainer programs, listed below.

What this means for defenders

1. Start with C and C++ code that parses untrusted input: decoders, compression, certificate and message parsing, protocol handlers, filesystems, and kernel interfaces reachable by unprivileged users or containers.
2. Then authorization and verification logic: signature checks, sessions, tenant isolation. Models find these when a validator tests the claimed effect.
3. Seed with your history. Give the agent your past CVEs and fix commits and ask for variants.
4. Require proof before a human looks: a reproducer that crashes under a sanitizer, or a payload a non-AI validator executes. Keep finder and verifier separate, and deduplicate by root cause.
5. Patch by reachability. First network-facing code reachable without login (BeyondTrust, PHP), then local privilege escalation on shared hosts (Copy Fail, SCTP), then bugs that need unusual configuration. Watch the KEV catalog.
6. Shorten your update path. A bug one lab found is likely being found by others. Chrome is moving to a two-week release cadence, and Project Zero argues for faster emergency updates. Measure your own time from advisory to deployed fix.
7. Delete attack surface. curl dropped its wolfSSH and Kerberos file-transfer code after reports against them rather than keep fixing it, and FreeBSD now documents that its storage failover listener must stay on trusted networks. Disable modules and listeners you do not use.
8. Change the class of code. PageBreak found only two XSS bugs across hundreds of Google apps built on high-assurance frameworks, out of more than 500 it found overall. Memory-safe languages do the same for the class that fills these tables.
9. If you maintain a project, publish your scope, set intake rules as the kernel and curl did, and ask for a reproducer and a patch.

As of 2026-10-25

What we could not verify

• Claims without identifiers: a Gemini 4 Argon healthcare bug, Gemini 3.5 Flash Cyber exploits in unnamed Google services, Qihoo 360’s Office claim (Microsoft’s credit omits AI), and a DeepSeek V8 claim with no code.
• Real bugs, no AI credit: fixes credited to OpenAI staff in Mozilla, FreeBSD, Samba, gVisor, PgBouncer, BIND, OpenSSH and others; NVIDIA AI Red Team’s Apple fixes; AntAISecurityLab and Texas A&M curl reports; OpenAI’s libssh, PHP and Chromium claims.
• Not discoveries: CodeMender’s fixes are patches. In the Dutch Institute for Vulnerability Disclosure’s Zammad breach, the institute described an AI agent driving the intrusion but did not say AI found the two Zammad zero-days it used.
• Counts that do not reconcile: Theori’s 34 real-world bugs against DARPA’s 18 for all teams; Team 42’s unnamed kernel bugs; reported OpenAI claims to dnsmasq and OpenSSL bugs that are credited to others.
• Gaps: Big Sleep’s tracker needs sign-in. We found no AI-credited zero-days from Meta, Amazon, NVIDIA or DeepSeek.

Sources

Google: OpenSSL 2024-10-16, Google fuzzing, Naptime to Big Sleep, CVE-2025-6965, Google summer 2025, CVE-2025-59734, Chrome 2025-08-26, Chrome blog, PageBreak, TechCrunch, Adkins, Emergency patching, GTIG exploitation, GTIG trends, DeepMind, Gemini 4 Argon, Pledge, Securin.

OpenAI: Heelan, GnuTLS, Codex Security, GnuPG, Mozilla 2026-45, Patch the Planet, OpenBSD, Apache httpd, CVE-2026-15903, JFrog, BleepingComputer on Artifactory, Wiz Artifactory, Trail of Bits, Node.js October, AI Weekly.

Anthropic: Zero-days, Mozilla 2026-13, Mozilla 2026-20, Mozilla 2026-30, Ghost, Mythos Preview, FreeBSD SA-26:08, OpenBSD errata, CVE-2026-31402, Carlini talk write-up, Botan, CVE-2026-5194, OpenSSL 2026-06-09, Windows, Apache, Mozilla on Mythos, CVD dashboard, Glasswing, Verification program, GLM-5.3.

Microsoft: Bootloaders, CVE-2026-41089, June cohort, FORGE, curl CVE-2026-9545, Node.js July, CVE-2026-64563, TechTimes.

Other labs: sm-crypto, FreeBSD SA-26:25, AISI, ThreatBook, SCTPhantom, ClamAV, Vghost, CVE-2026-42055, Xuanwu, Z.ai, Kimi K3 assessment, Redis, SecurityWeek, TechTimes on China, Unit 42.

Startups: curl data, Stenberg on AISLE, AISLE, Hacktron, Copy Fail, CISA KEV, depthfirst, Calif FreeBSD, XBOW, PHP Foundation, Calif PHP2Shell, Wiz PHP2Shell, Amazon, Xint CPython, Calif WeChat, OpenSSL 2026-01-27, Wiz Atlas.

AIxCC and universities: SQLite fix, Team Atlanta, DARPA, SoK, CVE-2026-31789, Xint and DARPA, Chrome 2026-04-15, AgentFlow, CVE-2026-11310, Chai.

Cost and policy: Attribution gap, SQLite CVEs, Mythos and curl, Chromium guidance, Google pause, Internet Bug Bounty, Kroah-Hartman, Torvalds, Kernel policy, curl bounty end, curl pause, curl public reports, Ignore the slop, curl wolfSSH, New analyzers, Georgia Tech, OpenSSF patches, OpenSSF maintainers, FFmpeg, FFmpeg and Google, Mozilla numbers, Schneier, Help Net Security, Zammad breach, Cloud Security Alliance, VulnCheck, The Register.

← All journal entries