AI Models Discover Zero-Day Vulnerabilities in Software
OpenAI's model testing identified nine zero-day security flaws in JFrog's Artifactory software during July 2026. The findings raise concerns about AI systems' capacity to autonomously discover and exploit critical vulnerabilities, with tech leaders predicting such capabilities could reach superhuman levels by late 2027.
What happened
OpenAI model testing identified nine zero-day vulnerabilities in JFrog's Artifactory software repository platform during July evaluations.
JFrog subsequently patched a critical vulnerability carrying a CVSS severity score of 9.8 that could be exploited without authentication, creating supply-chain risk.
Reported impact
Vercel CEO Guillermo Rauch linked the vulnerability disclosure to claims from OpenAI and Hugging Face about AI agents discovering zero-day vulnerabilities, arguing the timing could mark the first real-world sign that an AI system identified and potentially exploited a bug.
Tech leaders predict AI systems could reach superhuman capability at discovering and exploiting vulnerabilities by late 2027, potentially forcing companies to accelerate deployment of automated defenses or face autonomous attacks.
Index analysis
The incident demonstrates AI models' capacity to identify previously unknown software flaws through automated security testing, raising concerns about the dual-use potential of such capabilities.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.