Source: https://velofy.co/journal/zero-days-found-by-ai/

Published: 2026-10-25T00:00:00.000Z
Updated: 2026-10-25T03:48:25.000Z

[JOURNAL](https://velofy.co/journal/) / Security

# Zero-days found by AI systems: what the labs reported and what it costs

A sourced review of zero-days found by AI at Google, OpenAI, Anthropic, Microsoft and others, the patterns behind them, and what defenders should do.

Anish Kr Singh · 25 Oct 2026

Since 2024, artificial intelligence (AI) systems built or run by Google, OpenAI, Anthropic, Microsoft, Chinese labs, security startups and university teams have found hundreds of previously unknown vulnerabilities in software almost everyone runs: SQLite, FFmpeg, OpenSSL, Chrome, Firefox, the Linux, FreeBSD and OpenBSD kernels, Windows and curl. Most of the bugs with public identifiers are memory-safety bugs in old C and C++ code. Most of those listed here are patched, but the largest programs report far more finds than fixes. The slow part of security work has moved from finding bugs to checking and fixing them, and that changes what defenders should do.

## First principles

A zero-day is a vulnerability the maintainers do not know about, so no fix exists when it is found. A bug the vendor already had from another reporter is a duplicate, not a zero-day.

Finding one has always been expensive because it takes three kinds of work.

1.  **Reading code paths.** Follow untrusted input through code that may be decades old and very large, and spot where an assumption breaks.
2.  **Reaching the bug.** Build an input that passes every earlier check and arrives at the faulty line in the bad state. Fuzzers do this by volume, humans by reasoning.
3.  **Triage.** Reproduce each candidate, check whether an attacker can reach it, rate it, deduplicate it and write it up so a maintainer acts.

Models now do the first step well, because reading is cheap for them and runs in parallel. Anthropic, for example, ranks a project’s files by how likely they are to hold bugs and gives each agent a different file. Models are also good at variant analysis, which means taking a known fix and asking where else the same mistake appears, and at writing harnesses that reach a suspect line. Google’s OpenSSL find came from a large language model (LLM) writing fuzz targets, not from the model spotting the bug itself.

They still do triage badly on their own. In Sean Heelan’s larger test of OpenAI o3 on Linux kernel code, about one report in 50 was real, and Microsoft found that three of its tool’s top five findings in one bootloader filesystem parser were false positives. The precise systems put a check outside the model: a crash under a memory sanitizer, a validator that runs a real payload, or a human reviewer. Models are also poor at knowing whether a bug is new, so many reports turn out to be duplicates.

Most finds land in memory-unsafe C and C++ for mechanical reasons. In a memory-safe language an indexing mistake raises an error. In C and C++ it writes to the wrong memory, which an attacker can often turn into code execution. These languages also hold the oldest code that parses untrusted bytes: media decoders, kernels, browser engines and cryptographic libraries. And a memory bug comes with an objective test: if a crafted input crashes the program under a sanitizer, the bug is real. That makes this class the easiest for an agent to prove without a human.

## What the labs found

Identifiers are Common Vulnerabilities and Exposures (CVE) numbers where one exists.

### Google

Big Sleep is an agent from Google Project Zero and Google DeepMind. A human expert reviews each report before filing.

| Target | Bug class | Identifier | Date and status |
| --- | --- | --- | --- |
| OpenSSL (OSS-Fuzz-Gen) | Out-of-bounds read and write, about 20 years old | [CVE-2024-9143](https://openssl-library.org/news/secadv/20241016.txt) | 2024-10-16, patched, Low |
| SQLite generate\_series | Stack buffer underflow, from variant analysis of a commit | [Project Zero](https://projectzero.google/2024/10/from-naptime-to-big-sleep.html) | 2024-11-01, fixed before release |
| SQLite expressions | Integer overflow leading to memory corruption | [CVE-2025-6965](https://www.cve.org/CVERecord?id=CVE-2025-6965) | 2025-07-15, patched |
| FFmpeg | Seven heap writes, over-reads and a use-after-free | [CVE-2025-59734](https://www.cve.org/CVERecord?id=CVE-2025-59734) and six more | 2025-10-06, patched |
| Chrome V8 and graphics | Out-of-bounds writes, overflows, use-after-free (13 CVEs) | [CVE-2025-9478](https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_26.html) | August to November 2025, patched |
| Chrome navigation (Gemini harness) | Sandbox escape reading local files, over 13 years old | [CVE-2026-3545](https://blog.google/security/chrome-stronger-with-every-update/) | Fixed 2026-03-03 |
| Google web apps (PageBreak) | 500+ cross-site scripting (XSS) flaws | [Google](https://blog.google/security/agentic-hacks-real-proofs-inside-googles-pagebreak-project/) | 2026-09-24, internal apps, no CVEs |

Big Sleep also reported bugs in QuickJS, Apple WebKit, curl, ImageMagick, libxslt and cups-filters. The CVE-2025-6965 record credits a Google researcher assisted by Big Sleep, and Google’s statement that the find stopped planned exploitation names no actor.

### OpenAI

OpenAI’s agent, first called Aardvark, is now Codex Security. Partners such as Trail of Bits and Calif use its GPT-5.5-Cyber and GPT-5.6-Cyber models.

| Target | Bug class | Identifier | Date and status |
| --- | --- | --- | --- |
| Linux ksmbd (o3, Sean Heelan) | Use-after-free in session logoff | [CVE-2025-37899](https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/) | 2025-05-20, patched |
| GnuTLS | Double free, heap over-read | [CVE-2025-32988](https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html) and CVE-2025-32989 | 2025-07-09, patched |
| Firefox WebAssembly (OpenAI Preparedness) | Use-after-free, High | [CVE-2026-8390](https://www.mozilla.org/en-US/security/advisories/mfsa2026-45/) | 2026-05-12, patched |
| OpenBSD semaphores | Use-after-free to root, 23 years old per OpenAI | [CVE-2026-57589](https://github.com/openbsd/src/commit/1957873d2063db11dab780eca75b5e629d1e838d) | Fixed 2026-05-22 |
| Chrome V8 (GPT-5.6-Cyber) | Skipped bounds check, out-of-bounds read and write | [CVE-2026-15903](https://cveawg.mitre.org/api/cve/CVE-2026-15903) | 2026-07-20, patched |
| JFrog Artifactory | At least eight flaws credited to OpenAI: request forgery, path traversal, authorization bypass, possible code execution | [JFrog](https://jfrog.com/blog/jfrog-and-openai-collaboration-on-zero-day-security-findings/), [BleepingComputer](https://www.bleepingcomputer.com/news/security/openai-models-used-artifactory-zero-days-to-escape-to-the-internet/) | From 2026-07-27, patched |
| QEMU, Linux virtualization, libslirp (Trail of Bits) | Three zero-days chained into a virtual machine escape | [Trail of Bits](https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/) | 2026-08-26, partly patched |

OpenAI-credited fixes also shipped in [GnuPG](https://www.openwall.com/lists/oss-security/2026/01/27/8), [Apache httpd](https://httpd.apache.org/security/vulnerabilities_24.html) and the [Brotli decoder](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Credit is often indirect: GnuTLS credits the OpenAI Security Research Team and never mentions AI, and OpenAI tied the bugs to Codex Security [months later](https://openai.com/index/codex-security-now-in-research-preview/).

### Anthropic

Anthropic’s Frontier Red Team, its staff and partners such as Calif ran Claude Opus 4.6 and the restricted Claude Mythos Preview under Project Glasswing and a coordinated vulnerability disclosure (CVD) program.

| Target | Bug class | Identifier | Date and status |
| --- | --- | --- | --- |
| Firefox | 31 credited CVEs, mostly use-after-free | [Mozilla advisory](https://www.mozilla.org/en-US/security/advisories/mfsa2026-13/) and two more | 2026-02-24 to 2026-04-21, patched |
| Ghost publishing platform | Unauthenticated Structured Query Language (SQL) injection | [CVE-2026-26980](https://github.com/TryGhost/Ghost/security/advisories/GHSA-w52v-v783-gw97) | 2026-02-16, patched, then exploited |
| OpenBSD Transmission Control Protocol (TCP) stack (Mythos Preview) | 27-year-old remote kernel crash | [Errata 7.8 #025](https://cdn.openbsd.org/pub/OpenBSD/patches/7.8/common/025_sack.patch.sig) | Patched 2026-03-25 |
| FreeBSD Network File System (NFS) authentication (Mythos Preview) | 17-year-old remote kernel stack overflow, exploited by the model | [CVE-2026-4747](https://security.freebsd.org/advisories/FreeBSD-SA-26:08.rpcsec_gss.asc) | 2026-03-26, patched |
| Linux nfsd | Remote heap overflow in code from about 2003 | [CVE-2026-31402](https://www.cve.org/CVERecord?id=CVE-2026-31402) | 2026-04-03, patched |
| Botan, wolfSSL, Bouncy Castle | Certificate validation bypass and weak signature checks | [CVE-2026-34580](https://github.com/randombit/botan/security/advisories/GHSA-v782-6fq4-q827), [CVE-2026-5194](https://www.cve.org/CVERecord?id=CVE-2026-5194) | April 2026, patched |
| OpenSSL (Calif with Claude) | Heap use-after-free, High | [CVE-2026-45447](https://openssl-library.org/news/secadv/20260609.txt) | 2026-06-09, patched |

Claude is also credited on [Windows](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40398) and [Apache](https://cveawg.mitre.org/api/cve/CVE-2026-82459) fixes. Mozilla separately [used Mythos Preview](https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/) on Firefox and shipped fixes for 271 bugs in Firefox 150. Its [advisory](https://www.mozilla.org/en-US/security/advisories/mfsa2026-30/) lists no matching individual CVEs, only three roll-up memory-safety CVEs credited to Mozilla staff.

### Microsoft

Microsoft’s Autonomous Code Security team built a multi-model agentic scanning harness (MDASH), used by its Frontier Offensive Research and Generative Exploitation (FORGE) Lab.

| Target | Bug class | Identifier | Date and status |
| --- | --- | --- | --- |
| GRUB2, U-Boot, Barebox (Security Copilot) | 20 flaws, mostly overflows in filesystem parsers | [Microsoft](https://www.microsoft.com/en-us/security/blog/2025/03/31/analyzing-open-source-bootloaders-finding-vulnerabilities-faster-with-ai/) | 2025-03-31, patched |
| Windows networking and authentication | Four critical remote code execution bugs | [CVE-2026-41089](https://cveawg.mitre.org/api/cve/CVE-2026-41089) and three more | April and May 2026, patched |
| Windows kernel, HTTP.sys | Use-after-free and integer overflow, both scored 9.8 | [CVE-2026-45657, CVE-2026-47291](https://www.microsoft.com/en-us/security/blog/2026/06/17/beyond-the-benchmark-advancing-security-at-ai-speed/) | June 2026, patched |
| Node.js, Linux rhashtable | Use-after-free in both | [CVE-2026-56848](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases), [CVE-2026-64563](https://cveawg.mitre.org/api/cve/CVE-2026-64563) | July and August 2026, patched |

Microsoft’s open-source finds, including two Low curl flaws ([CVE-2026-9545](https://curl.se/docs/CVE-2026-9545.html) and CVE-2026-13608), carry AI credit only in the [FORGE post](https://www.microsoft.com/en-us/security/blog/2026/10/07/3-lessons-from-frontier-ai-vulnerability-research/), not in the CVE records.

### Other labs and public bodies

| Target | Finder and bug class | Identifier | Date and status |
| --- | --- | --- | --- |
| sm-crypto JavaScript package | Tencent Xuanwu Atuin; private-key recovery in the Chinese SM2 cipher | [CVE-2026-23966](https://osv.dev/vulnerability/GHSA-pgx9-497m-6c4v) | 2026-01-21, patched |
| FreeBSD thr\_kill2 | Tsinghua with Z.ai GLM-5.1; ignored permission check | [CVE-2026-45256](https://www.freebsd.org/security/advisories/FreeBSD-SA-26:25.thr.asc) | 2026-06-09, patched |
| Its own cloud platform | United Kingdom AI Security Institute (AISI); five-step isolation chain | [AISI](https://www.aisi.gov.uk/blog/finding-cloud-misconfigurations-with-frontier-ai-a-case-study) | 2026-07-07, fixed |
| Apple Libnotify | ThreatBook XGPT; out-of-bounds write | [CVE-2026-64739](https://threatbook.io/blog/apple-libnotify-cve-2026-64739) | 2026-07-27, patched |
| Linux Stream Control Transmission Protocol (SCTP) | Tencent Zhuque Corvus; 18-year-old use-after-free, container escape | [CVE-2026-64564](https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564) | 2026-08-04, patched |
| Unnamed browser JavaScript engine | Anthropic researcher with Z.ai GLM-5.3; bugs chained into file reads | [Anthropic](https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities) | 2026-09-29, disclosed |

Tencent’s labs also found a [ClamAV overflow](https://blog.clamav.net/2026/08/clamav-154-and-146-security-patch.html) and a [Linux vhost guest escape](https://matrix.tencent.com/en/2026/10/12/vghost-cve-2026-74580).

### Startups

| Target | Finder and bug class | Identifier | Date and status |
| --- | --- | --- | --- |
| curl | AISLE; 35 CVEs per curl’s lead developer, mostly Low, oldest in code from 2001 | [curl data](https://curl.se/docs/vuln.json) | November 2025 to October 2026, patched |
| BeyondTrust Remote Support | Hacktron; command injection without login | [CVE-2026-1731](https://www.hacktron.ai/blog/cve-2026-1731-beyondtrust-remote-support-rce) | 2026-02-06, patched, then exploited |
| Linux crypto interface | Xint Code (Theori); Copy Fail page-cache write to root | [CVE-2026-31431](https://xint.io/blog/copy-fail-linux-distributions) | 2026-04-29, patched, then exploited |
| FFmpeg | depthfirst; 21 bugs, mostly heap overflows, one from 2003 | [depthfirst](https://depthfirst.com/research/21-zero-days-in-ffmpeg) | 2026-06-02, 9 with CVEs assigned, 12 fixed without CVEs yet |
| FreeBSD storage failover listener | Calif with Claude Code; three remote root bugs without login | [Calif](https://blog.calif.io/p/the-taking-of-freebsd-one-two-three) | 2026-08-06, documented, not fixed |
| Chrome on Windows | XBOW on gpt-5.6-sol; three-bug sandbox escape, $250,000 reward | [XBOW](https://xbow.com/labs/research/zero-to-calc-in-six-days-inside-xbow-chrome-full-chain) | 2026-10-13, patched |
| PHP | Calif and OpenAI independently, Wiz with further attack paths; remote code execution without login | [CVE-2026-109618](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/) | 2026-10-21, patched |

Startups also reported a [CPython use-after-free](https://xint.io/blog/finding-and-patching-a-cpython-0day-in-hours-cve20266100-165230), a [WeChat zero-click worm](https://calif.io/research/weworm) and an [OpenSSL stack overflow](https://openssl-library.org/news/secadv/20260127.txt).

### AIxCC and university teams

The Defense Advanced Research Projects Agency (DARPA) ran the Artificial Intelligence Cyber Challenge (AIxCC), where finalist systems hunted planted bugs in real projects and also found real ones.

| Target | Finder and bug class | Identifier | Date and status |
| --- | --- | --- | --- |
| SQLite full-text search | Team Atlanta’s Atlantis; off-by-one leading to a NULL dereference | [Fix commit](https://github.com/sqlite/sqlite/commit/e9b919d550262076d1b8453c3d6852b88822b922) | 2024-08-06, patched |
| AIxCC final targets | All seven finalists; real bugs beside planted ones | [DARPA](https://www.darpa.mil/news/2025/aixcc-results) | 2025-08-08, disclosure ongoing |
| OpenSSL | Xint (Theori) under a DARPA bounty; 32-bit heap overflow | [CVE-2026-31789](https://cveawg.mitre.org/api/cve/CVE-2026-31789), [Xint](https://xint.io/blog/170315) | 2026-04-07, patched, Low |
| Chrome proxy code | University of California, Santa Barbara (AgentFlow on Kimi K2.5); use-after-free, Critical | [CVE-2026-6297](https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html) | 2026-04-15, patched |
| wolfSSL | University of California, Berkeley (Chai); certificate-chain bypass | [CVE-2026-11310](https://cveawg.mitre.org/api/cve/CVE-2026-11310), [Chai](https://arxiv.org/pdf/2606.26933) | 2026-06-25, patched |

## Patterns

**Memory safety leads.** By our count, about 30 of the 43 rows above are memory-safety bugs: out-of-bounds reads and writes, use-after-free, double free, and the integer overflows behind them, nearly all in C or C++. Most of the rest are authentication, authorization, certificate or configuration flaws, where nothing crashes.

**The code is old, parses untrusted input and was already fuzzed.** Finders report ages of 13 to 27 years for bugs in OpenSSL, OpenBSD, FreeBSD, Linux, Chrome and curl. 150 hours of processor time spent on conventional fuzzing missed Big Sleep’s SQLite bug. Such bugs need a precisely structured input or a rare state, which a model can reason towards and a random mutator rarely hits.

**Variant analysis works.** Big Sleep’s SQLite find started from a recent commit, [Anthropic’s Ghostscript bug](https://www.anthropic.com/research/zero-days) from git history, and Microsoft’s bootloader work found the same symlink overflow copied across three projects. Calif turned its first PHP finding into an instruction file for hunting variants.

**Logic bugs appear where they can be checked.** In 2026 more finds were cryptographic or authorization logic: certificate and signature checks in wolfSSL, Botan and Bouncy Castle, Artifactory, Google’s XSS bugs. PageBreak shows why: a validator that is not AI-written runs a real payload on each finding, giving logic bugs the objective test sanitizers give memory bugs.

**Finders converge.** Calif and OpenAI independently reported the root cause of PHP2Shell, and Wiz reported further attack paths. Five parties share credit for nginx [CVE-2026-42055](https://cveawg.mitre.org/api/cve/CVE-2026-42055), and AI-credited Apple fixes often list several reporters. Redis said the three publicly described Kimi K3 bugs were already in its bounty queue. If several labs find a bug within weeks, assume attackers can too.

**Exploitation is rare but predictable.** Most AI-found bugs have not been exploited (figures below). Those that were: BeyondTrust remote access without login; Ghost’s SQL injection, the [only exploited one](https://www.theregister.com/security/2026/09/21/anthropic-linked-cves-pile-up-attackers-mostly-shrug/5298018) among 225 Anthropic-linked CVEs; Copy Fail local root, added to the Cybersecurity and Infrastructure Security Agency (CISA) [Known Exploited Vulnerabilities (KEV) catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-31431); Artifactory CVE-2026-42016 in a [chained attack](https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201); and PHP2Shell, where [Amazon saw an attempt](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/) before disclosure. The Google Threat Intelligence Group (GTIG) also [reported](https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access/) a criminal group it believes used AI to find and weaponize a two-factor authentication bypass.

**Attribution is messy.** The CVE format has [no field for AI discovery](https://www.stingrai.io/blog/cve-credit-ai-attribution-gap-2026). Records name a model, a person working with Claude, or only a company, so counts of AI-found CVEs depend on parsing free text.

## The cost side

**False positives fall when proof is required.** SQLite’s [CVE page](https://www.sqlite.org/cves.html) marks six 2026 CVEs as apparent AI hallucinations, with no finder named. Daniel Stenberg said a [Mythos scan of curl](https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/) listed five confirmed vulnerabilities, of which one held up. Chromium’s [guidance](https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md) on AI-generated reports explains why some are invalid. In October, Google [stopped accepting product reports](https://www.bleepingcomputer.com/news/google/google-halts-open-source-bug-bounty-program-amid-ai-spam-surge/) to its open-source reward program, citing a rise in automated submissions it said were mostly invalid, and by April HackerOne’s Internet Bug Bounty had [paused submissions](https://www.csoonline.com/article/4154216/internet-bug-bounty-program-hits-pause-on-payouts-2.html).

**The larger cost is valid volume.** Greg Kroah-Hartman said kernel reports [turned from slop to real](https://theregister.com/2026/03/26/greg_kroahhartman_ai_kernel) around February 2026. By May, Linus Torvalds [said duplicate AI reports](https://www.tomshardware.com/software/linux/linus-torvalds-says-ai-bug-reports-have-made-the-linux-security-mailing-list-almost-entirely-unmanageable) had made the security list close to unmanageable, and the kernel now [treats AI-found bugs as public](https://docs.kernel.org/process/security-bugs.html). curl [ended its bounty](https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/) in January, [paused intake](https://daniel.haxx.se/blog/2026/06/15/curl-summer-of-bliss/) from July 1 to August 3, and from October 26 handles Low and Medium reports in public. Stenberg’s reason: “We must act to survive” ([curl blog](https://daniel.haxx.se/blog/2026/10/20/do-minor-curl-vulnerabilities-in-the-open/)). Microsoft’s FORGE Lab says the bottleneck has moved from discovery to deciding which reports are real, reachable and security-relevant.

**Patches lag finds.** Georgia Tech’s AIxCC systematization of knowledge (SoK) paper [found that 38 to 46 percent](https://www.cc.gatech.edu/news/georgia-tech-researchers-share-ai-cyber-challenge-lessons-usenix-security-2026) of patches from two baseline AI agents had semantic errors that only manual review caught, and an Open Source Security Foundation (OpenSSF) [review of 630 patches](https://openssf.org/?p=10753) found 20 to 40 percent wrong despite passing tests.

**Disputes.** FFmpeg objected to Google filing AI-found bugs with disclosure deadlines [without sending patches](https://piunikaweb.com/2025/11/06/google-vs-ffmpeg-open-source-big-sleep-ai-bugs-and-who-must-fix-them/). Michael Niedermayer, its main security fixer, said he had [fixed most of the Big Sleep issues](https://thenewstack.io/ffmpeg-to-google-fund-us-or-stop-sending-bugs/) and called Google helpful. A critic questioned how Mozilla’s 271 Mythos finds [reconcile with its advisories](https://www.flyingpenguin.com/mythos-mystery-in-mozilla-numbers-how-22-vulns-became-271-or-maybe-3-in-april/) before accepting that roll-up CVEs could explain the count, Bruce Schneier questioned the [low patch rate](https://schneier.com/blog/archives/2026/06/anthropics-project-glasswing-update.html), and [Help Net Security](https://www.helpnetsecurity.com/2026/09/04/echo-claude-mythos-vulnerability-findings/) reported that, as of May 22, most Mythos Preview candidates had not been reviewed by anyone outside Anthropic. Redis said the Kimi K3 bugs it could see [duplicated earlier reports](https://redis.io/blog/security-update-redis-response-to-the-kimi-k3-vulnerability-claims/) and that it had no details on the rest. TechTimes reports that Chinese rules require new bugs to reach a ministry [within 48 hours](https://www.techtimes.com/articles/319269/20260629/china-builds-ai-vulnerability-scanner-counter-mythos-every-zero-day-goes-beijing-law.htm), possibly before vendors hear.

**The other side.** A [write-up of a talk](https://thecyberarchive.com/talks/ai-vulnerability-discovery-google-big-sleep-code-mender/) by Google’s Heather Adkins says all but five Big Sleep finds had been fixed at the time. Stenberg now says [slop has nearly vanished](https://daniel.haxx.se/blog/2026/10/22/ignore-the-slop/), and in 2025 he wrote that a [new breed of AI analyzers](https://daniel.haxx.se/blog/2025/10/10/) saw patterns older tools had missed. Maintainers of the CUPS printing system [welcomed AIxCC reports](https://openssf.org/?p=9567) that came with patches. The labs also fund maintainer programs, listed below.

## What this means for defenders

1.  **Start with C and C++ code that parses untrusted input:** decoders, compression, certificate and message parsing, protocol handlers, filesystems, and kernel interfaces reachable by unprivileged users or containers.
2.  **Then authorization and verification logic:** signature checks, sessions, tenant isolation. Models find these when a validator tests the claimed effect.
3.  **Seed with your history.** Give the agent your past CVEs and fix commits and ask for variants.
4.  **Require proof before a human looks:** a reproducer that crashes under a sanitizer, or a payload a non-AI validator executes. Keep finder and verifier separate, and deduplicate by root cause.
5.  **Patch by reachability.** First network-facing code reachable without login (BeyondTrust, PHP), then local privilege escalation on shared hosts (Copy Fail, SCTP), then bugs that need unusual configuration. Watch the KEV catalog.
6.  **Shorten your update path.** A bug one lab found is likely being found by others. Chrome is moving to a [two-week release cadence](https://blog.google/security/chrome-stronger-with-every-update/), and Project Zero argues for [faster emergency updates](https://projectzero.google/2026/10/emergency-patching.html). Measure your own time from advisory to deployed fix.
7.  **Delete attack surface.** curl dropped its [wolfSSH](https://curl.se/docs/CVE-2025-10966.html) and [Kerberos file-transfer](https://daniel.haxx.se/blog/2025/10/10/) code after reports against them rather than keep fixing it, and FreeBSD now documents that its storage failover listener must stay on trusted networks. Disable modules and listeners you do not use.
8.  **Change the class of code.** PageBreak found only two XSS bugs across hundreds of Google apps built on high-assurance frameworks, out of more than 500 it found overall. Memory-safe languages do the same for the class that fills these tables.
9.  **If you maintain a project,** publish your scope, set intake rules as the kernel and curl did, and ask for a reproducer and a patch.

## As of 2026-10-25

| Measure | Value | Source |
| --- | --- | --- |
| Anthropic CVD dashboard | 29,439 candidates; 6,157 disclosed in 591 projects; 516 patched; 219 CVEs; 92.7% true positive on 6,123 reviewed; 4,824 sent unreviewed | [Anthropic](https://red.anthropic.com/2026/cvd/), 2026-10-02 |
| Glasswing | 129,000+ verified vulnerabilities from April to July per partner surveys, 33,000+ critical or high; about 6% of 1,596 early disclosures patched by May 22 | [Anthropic](https://www.anthropic.com/news/cyber-verification-program), 2026-10-06; [Cloud Security Alliance](https://labs.cloudsecurityalliance.org/research/csa-research-note-oss-disclosure-system-strain-20261007-csa/) |
| OpenAI Patch the Planet | 68 codebases, 1,995 issues, 466 patches accepted upstream, program-reported | [AI Weekly](https://aiweekly.co/alerts/openai-patch-the-planet-logs-1995-issues-466-merged-upstream), 2026-10-21 |
| Microsoft FORGE | 140 Windows CVEs, May to September; 155 open-source reports, 93 acknowledged | [Microsoft](https://www.microsoft.com/en-us/security/blog/2026/10/07/3-lessons-from-frontier-ai-vulnerability-research/), 2026-10-07 |
| Chrome | 1,072 security bugs fixed in Chrome 149 and 150, helped by model-written fixes; no AI discovery share given | [Google](https://blog.google/security/chrome-stronger-with-every-update/), 2026-07-30 |
| Big Sleep | 43 credited CVEs in one public tracker | [Securin](https://github.com/securin-public/frontier-ai-cve-tracker), 2026-10-04 |
| AISLE | 515 CVEs, per its own page | [AISLE](https://aisle.com/cve-discoveries) |
| curl | 69 advisories published in 2026 (63 with 2026 identifiers), against 6 to 21 a year from 2019 to 2025 | [curl data](https://curl.se/docs/vuln.json), 2026-10-14 |
| Firefox 150 | 271 Mythos Preview finds; the advisory has 3 roll-up memory-safety CVEs | [Mozilla](https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/), 2026-04-21 |
| All CVEs | Monthly disclosures up from 5,045 in January to 10,740 in August; half of AI-discovered bugs lead to remote code execution, against 26% across all CVEs | [GTIG](https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era), 2026-10-01 |
| Exploited | 14 of 1,061 AI-assisted finds (1.3%), first half of 2026; 1 of 225 Anthropic-linked CVEs | [VulnCheck](https://www.vulncheck.com/blog/state-of-exploitation-1h-2026); [The Register](https://www.theregister.com/security/2026/09/21/anthropic-linked-cves-pile-up-attackers-mostly-shrug/5298018) |
| AIxCC | 18 real bugs in the final; 25 zero-days in 10 projects, 12 patched (overlapping counts) | [DARPA](https://www.darpa.mil/news/2025/aixcc-results); [SoK](https://arxiv.org/html/2602.07666v1) |
| Programs | Glasswing up to $100 million in credits plus $4 million in donations; $12.5 million pledged to open-source security by five companies | [Anthropic](https://www.anthropic.com/glasswing); [Google](https://blog.google/innovation-and-ai/technology/safety-security/ai-powered-open-source-security/) |
| Benchmarks on known bugs | CyberGym: MDASH 96.55% (88.45% at launch in May), Tencent Atuin 84.0%. ExploitBench: Kimi K3 32%, GLM-5.2 24% | [TechTimes](https://www.techtimes.com/articles/317692/20260603/microsoft-mdash-gains-defender-integration-build-2026-9655-cybergym-benchmark.htm); [Xuanwu](https://xlab.tencent.com/en/2026/07/02/xuanwu-atuin-cybergym/); [Joint government assessment](https://www.nist.gov/news-events/news/2026/07/uk-aisi-caisi-preliminary-assessment-kimi-k3s-cyber-capabilities) |
| Unverified totals | Z.ai 2,436; Palo Alto Networks Unit 42 14,090; Wiz Atlas 200+; Qihoo 360 near 1,000 | [Z.ai](https://docs.z.ai/guides/llm/glm-5.3); [Unit 42](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/); [Wiz](https://www.wiz.io/blog/atlas-ai-vulnerability-researcher); [SecurityWeek](https://www.securityweek.com/chinese-cybersecurity-firms-ai-hacking-claims-draw-comparisons-to-claude-mythos/) |

## What we could not verify

*   **Claims without identifiers:** a Gemini 4 Argon healthcare bug, Gemini 3.5 Flash Cyber exploits in unnamed Google services, Qihoo 360’s Office claim (Microsoft’s credit omits AI), and a DeepSeek V8 claim with no code.
*   **Real bugs, no AI credit:** fixes credited to OpenAI staff in Mozilla, FreeBSD, Samba, gVisor, PgBouncer, BIND, OpenSSH and others; NVIDIA AI Red Team’s Apple fixes; AntAISecurityLab and Texas A&M curl reports; OpenAI’s libssh, PHP and Chromium claims.
*   **Not discoveries:** CodeMender’s fixes are patches. In the Dutch Institute for Vulnerability Disclosure’s Zammad breach, the institute described an AI agent driving the intrusion but did not say AI found the two Zammad zero-days it used.
*   **Counts that do not reconcile:** Theori’s 34 real-world bugs against DARPA’s 18 for all teams; Team 42’s unnamed kernel bugs; reported OpenAI claims to dnsmasq and OpenSSL bugs that are credited to others.
*   **Gaps:** Big Sleep’s tracker needs sign-in. We found no AI-credited zero-days from Meta, Amazon, NVIDIA or DeepSeek.

## Sources

**Google:** [OpenSSL 2024-10-16](https://openssl-library.org/news/secadv/20241016.txt), [Google fuzzing](https://security.googleblog.com/2024/11/leveling-up-fuzzing-finding-more.html), [Naptime to Big Sleep](https://projectzero.google/2024/10/from-naptime-to-big-sleep.html), [CVE-2025-6965](https://www.cve.org/CVERecord?id=CVE-2025-6965), [Google summer 2025](https://blog.google/technology/safety-security/cybersecurity-updates-summer-2025/), [CVE-2025-59734](https://www.cve.org/CVERecord?id=CVE-2025-59734), [Chrome 2025-08-26](https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_26.html), [Chrome blog](https://blog.google/security/chrome-stronger-with-every-update/), [PageBreak](https://blog.google/security/agentic-hacks-real-proofs-inside-googles-pagebreak-project/), [TechCrunch](https://techcrunch.com/2025/08/04/google-says-its-ai-based-bug-hunter-found-20-security-vulnerabilities/), [Adkins](https://thecyberarchive.com/talks/ai-vulnerability-discovery-google-big-sleep-code-mender/), [Emergency patching](https://projectzero.google/2026/10/emergency-patching.html), [GTIG exploitation](https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access/), [GTIG trends](https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era), [DeepMind](https://deepmind.google/blog/introducing-gemini-3-5-flash-cyber), [Gemini 4 Argon](https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-4-argon/), [Pledge](https://blog.google/innovation-and-ai/technology/safety-security/ai-powered-open-source-security/), [Securin](https://github.com/securin-public/frontier-ai-cve-tracker).

**OpenAI:** [Heelan](https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/), [GnuTLS](https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html), [Codex Security](https://openai.com/index/codex-security-now-in-research-preview/), [GnuPG](https://www.openwall.com/lists/oss-security/2026/01/27/8), [Mozilla 2026-45](https://www.mozilla.org/en-US/security/advisories/mfsa2026-45/), [Patch the Planet](https://openai.com/index/patch-the-planet/), [OpenBSD](https://github.com/openbsd/src/commit/1957873d2063db11dab780eca75b5e629d1e838d), [Apache httpd](https://httpd.apache.org/security/vulnerabilities_24.html), [CVE-2026-15903](https://cveawg.mitre.org/api/cve/CVE-2026-15903), [JFrog](https://jfrog.com/blog/jfrog-and-openai-collaboration-on-zero-day-security-findings/), [BleepingComputer on Artifactory](https://www.bleepingcomputer.com/news/security/openai-models-used-artifactory-zero-days-to-escape-to-the-internet/), [Wiz Artifactory](https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201), [Trail of Bits](https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/), [Node.js October](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases), [AI Weekly](https://aiweekly.co/alerts/openai-patch-the-planet-logs-1995-issues-466-merged-upstream).

**Anthropic:** [Zero-days](https://www.anthropic.com/research/zero-days), [Mozilla 2026-13](https://www.mozilla.org/en-US/security/advisories/mfsa2026-13/), [Mozilla 2026-20](https://www.mozilla.org/en-US/security/advisories/mfsa2026-20/), [Mozilla 2026-30](https://www.mozilla.org/en-US/security/advisories/mfsa2026-30/), [Ghost](https://github.com/TryGhost/Ghost/security/advisories/GHSA-w52v-v783-gw97), [Mythos Preview](https://www.anthropic.com/research/mythos-preview), [FreeBSD SA-26:08](https://security.freebsd.org/advisories/FreeBSD-SA-26:08.rpcsec_gss.asc), [OpenBSD errata](https://cdn.openbsd.org/pub/OpenBSD/patches/7.8/common/025_sack.patch.sig), [CVE-2026-31402](https://www.cve.org/CVERecord?id=CVE-2026-31402), [Carlini talk write-up](https://mtlynch.io/claude-code-found-linux-vulnerability), [Botan](https://github.com/randombit/botan/security/advisories/GHSA-v782-6fq4-q827), [CVE-2026-5194](https://www.cve.org/CVERecord?id=CVE-2026-5194), [OpenSSL 2026-06-09](https://openssl-library.org/news/secadv/20260609.txt), [Windows](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40398), [Apache](https://cveawg.mitre.org/api/cve/CVE-2026-82459), [Mozilla on Mythos](https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/), [CVD dashboard](https://red.anthropic.com/2026/cvd/), [Glasswing](https://www.anthropic.com/glasswing), [Verification program](https://www.anthropic.com/news/cyber-verification-program), [GLM-5.3](https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities).

**Microsoft:** [Bootloaders](https://www.microsoft.com/en-us/security/blog/2025/03/31/analyzing-open-source-bootloaders-finding-vulnerabilities-faster-with-ai/), [CVE-2026-41089](https://cveawg.mitre.org/api/cve/CVE-2026-41089), [June cohort](https://www.microsoft.com/en-us/security/blog/2026/06/17/beyond-the-benchmark-advancing-security-at-ai-speed/), [FORGE](https://www.microsoft.com/en-us/security/blog/2026/10/07/3-lessons-from-frontier-ai-vulnerability-research/), [curl CVE-2026-9545](https://curl.se/docs/CVE-2026-9545.html), [Node.js July](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases), [CVE-2026-64563](https://cveawg.mitre.org/api/cve/CVE-2026-64563), [TechTimes](https://www.techtimes.com/articles/317692/20260603/microsoft-mdash-gains-defender-integration-build-2026-9655-cybergym-benchmark.htm).

**Other labs:** [sm-crypto](https://osv.dev/vulnerability/GHSA-pgx9-497m-6c4v), [FreeBSD SA-26:25](https://www.freebsd.org/security/advisories/FreeBSD-SA-26:25.thr.asc), [AISI](https://www.aisi.gov.uk/blog/finding-cloud-misconfigurations-with-frontier-ai-a-case-study), [ThreatBook](https://threatbook.io/blog/apple-libnotify-cve-2026-64739), [SCTPhantom](https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564), [ClamAV](https://blog.clamav.net/2026/08/clamav-154-and-146-security-patch.html), [Vghost](https://matrix.tencent.com/en/2026/10/12/vghost-cve-2026-74580), [CVE-2026-42055](https://cveawg.mitre.org/api/cve/CVE-2026-42055), [Xuanwu](https://xlab.tencent.com/en/2026/07/02/xuanwu-atuin-cybergym/), [Z.ai](https://docs.z.ai/guides/llm/glm-5.3), [Kimi K3 assessment](https://www.nist.gov/news-events/news/2026/07/uk-aisi-caisi-preliminary-assessment-kimi-k3s-cyber-capabilities), [Redis](https://redis.io/blog/security-update-redis-response-to-the-kimi-k3-vulnerability-claims/), [SecurityWeek](https://www.securityweek.com/chinese-cybersecurity-firms-ai-hacking-claims-draw-comparisons-to-claude-mythos/), [TechTimes on China](https://www.techtimes.com/articles/319269/20260629/china-builds-ai-vulnerability-scanner-counter-mythos-every-zero-day-goes-beijing-law.htm), [Unit 42](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/).

**Startups:** [curl data](https://curl.se/docs/vuln.json), [Stenberg on AISLE](https://daniel.haxx.se/blog/2026/10/14/a-curl-audit-by-aisle/), [AISLE](https://aisle.com/cve-discoveries), [Hacktron](https://www.hacktron.ai/blog/cve-2026-1731-beyondtrust-remote-support-rce), [Copy Fail](https://xint.io/blog/copy-fail-linux-distributions), [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-31431), [depthfirst](https://depthfirst.com/research/21-zero-days-in-ffmpeg), [Calif FreeBSD](https://blog.calif.io/p/the-taking-of-freebsd-one-two-three), [XBOW](https://xbow.com/labs/research/zero-to-calc-in-six-days-inside-xbow-chrome-full-chain), [PHP Foundation](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/), [Calif PHP2Shell](https://calif.io/php2shell/), [Wiz PHP2Shell](https://www.wiz.io/blog/php2shell-php-rce), [Amazon](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/), [Xint CPython](https://xint.io/blog/finding-and-patching-a-cpython-0day-in-hours-cve20266100-165230), [Calif WeChat](https://calif.io/research/weworm), [OpenSSL 2026-01-27](https://openssl-library.org/news/secadv/20260127.txt), [Wiz Atlas](https://www.wiz.io/blog/atlas-ai-vulnerability-researcher).

**AIxCC and universities:** [SQLite fix](https://github.com/sqlite/sqlite/commit/e9b919d550262076d1b8453c3d6852b88822b922), [Team Atlanta](https://team-atlanta.github.io/blog/post-asc-sqlite/), [DARPA](https://www.darpa.mil/news/2025/aixcc-results), [SoK](https://arxiv.org/html/2602.07666v1), [CVE-2026-31789](https://cveawg.mitre.org/api/cve/CVE-2026-31789), [Xint and DARPA](https://xint.io/blog/170315), [Chrome 2026-04-15](https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html), [AgentFlow](https://arxiv.org/abs/2604.20801), [CVE-2026-11310](https://cveawg.mitre.org/api/cve/CVE-2026-11310), [Chai](https://arxiv.org/pdf/2606.26933).

**Cost and policy:** [Attribution gap](https://www.stingrai.io/blog/cve-credit-ai-attribution-gap-2026), [SQLite CVEs](https://www.sqlite.org/cves.html), [Mythos and curl](https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/), [Chromium guidance](https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md), [Google pause](https://www.bleepingcomputer.com/news/google/google-halts-open-source-bug-bounty-program-amid-ai-spam-surge/), [Internet Bug Bounty](https://www.csoonline.com/article/4154216/internet-bug-bounty-program-hits-pause-on-payouts-2.html), [Kroah-Hartman](https://theregister.com/2026/03/26/greg_kroahhartman_ai_kernel), [Torvalds](https://www.tomshardware.com/software/linux/linus-torvalds-says-ai-bug-reports-have-made-the-linux-security-mailing-list-almost-entirely-unmanageable), [Kernel policy](https://docs.kernel.org/process/security-bugs.html), [curl bounty end](https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/), [curl pause](https://daniel.haxx.se/blog/2026/06/15/curl-summer-of-bliss/), [curl public reports](https://daniel.haxx.se/blog/2026/10/20/do-minor-curl-vulnerabilities-in-the-open/), [Ignore the slop](https://daniel.haxx.se/blog/2026/10/22/ignore-the-slop/), [curl wolfSSH](https://curl.se/docs/CVE-2025-10966.html), [New analyzers](https://daniel.haxx.se/blog/2025/10/10/), [Georgia Tech](https://www.cc.gatech.edu/news/georgia-tech-researchers-share-ai-cyber-challenge-lessons-usenix-security-2026), [OpenSSF patches](https://openssf.org/?p=10753), [OpenSSF maintainers](https://openssf.org/?p=9567), [FFmpeg](https://thenewstack.io/ffmpeg-to-google-fund-us-or-stop-sending-bugs/), [FFmpeg and Google](https://piunikaweb.com/2025/11/06/google-vs-ffmpeg-open-source-big-sleep-ai-bugs-and-who-must-fix-them/), [Mozilla numbers](https://www.flyingpenguin.com/mythos-mystery-in-mozilla-numbers-how-22-vulns-became-271-or-maybe-3-in-april/), [Schneier](https://schneier.com/blog/archives/2026/06/anthropics-project-glasswing-update.html), [Help Net Security](https://www.helpnetsecurity.com/2026/09/04/echo-claude-mythos-vulnerability-findings/), [Zammad breach](https://www.helpnetsecurity.com/2026/10/01/divd-agentic-ai-attack-breach/), [Cloud Security Alliance](https://labs.cloudsecurityalliance.org/research/csa-research-note-oss-disclosure-system-strain-20261007-csa/), [VulnCheck](https://www.vulncheck.com/blog/state-of-exploitation-1h-2026), [The Register](https://www.theregister.com/security/2026/09/21/anthropic-linked-cves-pile-up-attackers-mostly-shrug/5298018).

[← All journal entries](https://velofy.co/journal/)