--- title: AI finds exploits in hours for $25. Patching still takes... description: JPMorgan Chase's 'Patchmageddon' report warns that AI is discovering vulnerabilities far faster than the industry can patch them. The median time from... canonical: https://daily.dev/posts/ai-finds-exploits-in-hours-for-25-patching-still-takes-months--5dzgahggw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AI finds exploits in hours for $25. Patching still takes months. | daily.dev og:description: JPMorgan Chase's 'Patchmageddon' report warns that AI is discovering vulnerabilities far faster than the industry can patch them. The median time from... og:url: https://daily.dev/posts/ai-finds-exploits-in-hours-for-25-patching-still-takes-months--5dzgahggw og:image: https://api.daily.dev/og/posts/5dzgahggW.png og:image:alt: AI finds exploits in hours for $25. Patching still takes months. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AI finds exploits in hours for $25. Patching still takes months. **[Trends](https://daily.dev/sources/trends)** · 3 min read · 1 upvotes · 1 comments ## Summary JPMorgan Chase's 'Patchmageddon' report warns that AI is discovering vulnerabilities far faster than the industry can patch them. The median time from disclosure to exploitation has dropped to zero days in 2026, with nearly 80% of attacks occurring on or before disclosure day. A concrete example: GPT-5 found a pre-auth RCE exploit chain in WordPress in ~10 hours for $25 in API costs. On the defensive side, 60% of breaches involve already-patched vulnerabilities that simply weren't deployed, and 80%+ of security professionals have delayed patches to avoid disruption. Open source is especially vulnerable — 55% of projects have a single maintainer, and Anthropic found 23,000+ potential vulnerabilities with only 75 of 530 submitted fixes actually applied. Industrial infrastructure is even more exposed, with 12-20% of hardware technically unpatchable. Defensive AI tools are making progress but face a structural disadvantage: attackers only need to find one path in. ## Content JPMorgan Chase dropped a report called "Patchmageddon" this week, and the headline number is genuinely alarming: AI discovers vulnerabilities 16.5 times faster than the industry can patch them. In 2025, 48,185 vulnerabilities were disclosed. About 7,500 got patched. The mechanics are worth understanding. Models like Anthropic's Claude Mythos don't just find bugs — they chain low-severity flaws into critical attack paths, reverse-engineer patches to find what they fixed, and generate working exploits. Anthropic's own testing showed Mythos turned a known vulnerability into a privilege escalation attack in under a day for less than $2,000, no human required. A security researcher separately used GPT-5 to find a WordPress exploit chain worth $500k on the broker market — 10 hours, $25 in API costs. The asymmetry JPMorgan is pointing at is structural, not temporary. Attackers need one path. Defenders have to cover everything: every dependency, every legacy system, every unmaintained open source library. And there are a lot of those. About 96-99% of commercial codebases contain open source components, 55% of open source projects have exactly one maintainer, and 95% of open source vulnerabilities live in transitive dependencies most companies don't even know they're running. Here's where it gets complicated, though. VulnCheck researcher Patrick Garrity looked at actual exploitation data and found only 1.3% of AI-discovered vulnerabilities have been exploited in the wild — no higher than the historical baseline. Of Anthropic's 23,000 Project Glasswing findings, one was confirmed exploited. The median time from CVE to exploitation dropped from 120 to 80 days, which is bad, but it's not the "zero-day norm" the JPMorgan report implies is already here. So there's a real tension in the discourse right now. The JPMorgan framing — that we're entering an era of automated, near-instant exploitation — is a plausible near-future scenario, not a current reality. Hugging Face CEO Clément Delangue is calling for acceleration, not slowdown, arguing defenders with open models can outpace attackers if given the right tools. The Dark Reading journalists covering Mythos are more skeptical, noting that Anthropic's self-reported numbers are nearly impossible to independently verify. What's not in dispute: the volume of known vulnerabilities is exploding (45,207 in the first seven months of 2026 alone), patch cycles haven't gotten faster, and industrial systems — power grids, water treatment, manufacturing — run on hardware that's often technically unpatchable. That last part is the one that should keep people up at night, regardless of where the exploitation rate sits today. ## Community discussion Top comments from developers on daily.dev. **@baz14** · 0 upvotes > No product is perfect. A product is tested for a specific use case. AI introduces its own use case that hasn't been tested. Security systems are always updated only after a hack. > > Fixing the problem by banning the use of AI is unwise. If a system can be hacked, it will be hacked. New approaches to security are needed in a world with AI. ## Similar posts on daily.dev - [From Zero-Day to Zero-Hour: How AI Compresses the Vulnerability Lifecycle](https://daily.dev/posts/from-zero-day-to-zero-hour-how-ai-compresses-the-vulnerability-lifecycle-5dcwvg44s) · Security Boulevard · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#ai-security](https://daily.dev/tags/ai-security) [View this post on daily.dev](https://daily.dev/posts/ai-finds-exploits-in-hours-for-25-patching-still-takes-months--5dzgahggw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AI finds exploits in hours for $25. Patching still takes months.","url":"https://daily.dev/posts/ai-finds-exploits-in-hours-for-25-patching-still-takes-months--5dzgahggw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ai-finds-exploits-in-hours-for-25-patching-still-takes-months--5dzgahggw"},"datePublished":"2026-07-27T17:01:31.560Z","dateModified":"2026-08-03T15:10:50.334Z","description":"JPMorgan Chase's 'Patchmageddon' report warns that AI is discovering vulnerabilities far faster than the industry can patch them. The median time from...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/293af22dda36d0fffb0f0d0de18d29a2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/293af22dda36d0fffb0f0d0de18d29a2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Trends","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trends","logo":"https://media.daily.dev/image/upload/s--ZfSp3asX--/f_auto,q_auto/v1780996004/logos/trends?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trends"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/ai-finds-exploits-in-hours-for-25-patching-still-takes-months--5dzgahggw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,open-source,ai-security","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trends","item":"https://daily.dev/sources/trends"},{"@type":"ListItem","position":3,"name":"AI finds exploits in hours for $25. Patching still takes months."}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/ai-finds-exploits-in-hours-for-25-patching-still-takes-months--5dzgahggw","comment":[{"@type":"Comment","text":"No product is perfect. A product is tested for a specific use case. AI introduces its own use case that hasn’t been tested. Security systems are always updated only after a hack.\nFixing the problem by banning the use of AI is unwise. If a system can be hacked, it will be hacked. New approaches to security are needed in a world with AI.","datePublished":"2026-07-29T07:33:02.633Z","url":"https://daily.dev/posts/5dzgahggW#c-60qZ7hvCs","author":{"@type":"Person","name":"Baz","url":"https://daily.dev/baz14","image":"https://lh3.googleusercontent.com/a/ACg8ocKd2iFU8YS4sV-rBJptuYSF8EHeQnm23N_dcXE1uON7_GMIlZg=s96-c"}}]} ```