AI models Claude Mythos and GPT-5.5 demonstrate capability to exploit zero-day vulnerabilities
New AI models from Anthropic and OpenAI have demonstrated ability to find and exploit zero-day vulnerabilities at scale, with Claude Mythos finding thousands of high-severity flaws and achieving 72% exploitation success rate, while the time from vulnerability disclosure to exploitation has compressed from 771 days in 2018 to 4 hours in 2024 and even pre-disclosure exploitation in 2026.
What happened
Anthropic's Claude Mythos Preview model found thousands of high-severity vulnerabilities in mainstream operating systems and web browsers, with a 72% exploitation success rate, and discovered a zero-day flaw in OpenBSD that had remained hidden for 27 years.
OpenAI's GPT-5.5 is reported to substantially improve the efficiency and scale of existing attack techniques, enabling faster conversion of vulnerabilities into operational attack tools.
According to the Zero Day Clock tracking, the median time between vulnerability disclosure and exploitation compressed from 771 days in 2018 to 4 hours in 2024, and by 2026 vulnerabilities are being exploited before public disclosure.
Reported impact
AI tools have reduced attack costs and expanded targeting scope; past attacks focused on large enterprises, but AI-enabled automated scanning now makes mid-size and small businesses and local government agencies viable targets.
Previously difficult-to-exploit or low-impact vulnerabilities that were deprioritized in patching queues may now be weaponized through AI, changing the threat landscape for dormant systems.
Index analysis
Taiwan's Cybersecurity Administration assessed that AI is fundamentally changing the speed and cost of attacks, shifting security practice from attack prevention to rapid recovery and damage limitation.
The administration identified a paradigm shift from preventing breach to fast recovery, recommending enterprises prioritize resilience and business continuity planning over pure prevention-focused investments.
Governance controls
Taiwan's Cybersecurity Administration announced three response measures: acquiring tools and knowledge on AI-enabled defense, convening stakeholder decision-makers to develop national strategy, and strengthening support for small and medium-sized enterprises through Taiwan's CERT/CC.
The administration recommended strategy, management, and technical responses including elevating vulnerability management to operational risk level, implementing multi-factor authentication and FIDO2-based Passkeys, and establishing business continuity planning drills.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.