Hackers used to take five days to start attacking a new security bug. Now they take less than a day. About 28% of new bugs, each given an official ID number called a CVE, get hit within 24 hours of being announced. Sometimes the working attack shows up before the official fix does.
The change is simple. Attackers are using AI to read the patch notes, the fix and the short writeup explaining what it fixed, figure out the problem, and write working attack code in hours.
The Hacker News Year AI Assisted Attacks
How attackers turn fixes into attacks
The new attacker routine works like this.
- A vendor releases a fix and a note describing it.
- A bot downloads the old and new versions of the software and compares them line by line. Whatever changed is the bug.
- An AI writes a small program that triggers that exact bug.
- A second tool turns that program into a real attack.
Total time from "fix released" to "weapon ready" is often under four hours.
A normal company patch cycle takes days or weeks. Test in staging, wait for the change window, pilot, roll out in waves. That math no longer works when attackers are this fast.
Infosecurity Magazine AI Raises Bar Vulnerability Awareness Secure
The Mythos panic was overblown
Last month Reuters reported that Anthropic's new Mythos AI model would supercharge hacking. Followup reporting walked it back. Mythos is good at writing code and doing research but it is not a magic attack factory.
The real speedups come from ordinary automation. Web scrapers, code-comparison tools, fuzzers (programs that throw random input at software to see what breaks), and mid-tier AI gluing the pieces together. A small group with $40 of AI credits can turn a fix into a working attack within a day. This is no longer government-level work.
Reuters Fears Unfettered Hacking Spurred Anthropics Mythos
What defense looks like
- Patch in hours, not weeks. The clock now runs at attacker speed.
- Run a shield in front of your app. A Web Application Firewall (WAF) or modern endpoint protection that blocks the attack pattern before you install the real fix.
- Keep a list of every piece of software you run. Without that list, the next critical bug eats you because you cannot answer "do we use this thing".
- Use the same patch-comparison tools attackers use, but on your own software. They are now standard defender tools too.
WEF Global Cybersecurity Outlook 2026
What is next
AI-driven attacks are already here. The open question is whether defenders close the same loop. Microsoft, CrowdStrike, and a handful of startups are using AI to handle incidents, generate detection rules from threat reports, and auto-write patches. Some of it works. Some is marketing.
The 2027 outlook depends on which side moves faster. Right now attackers are ahead, because they only need one bug to win while defenders have to fix every single one. Same old problem, running at AI speed.
