--- title: From Zero-Day to Zero-Hour: How AI Compresses the... description: AI has collapsed the traditional vulnerability lifecycle from months to hours. Anthropic's Claude Mythos Preview found thousands of zero-day vulnerabilities... canonical: https://daily.dev/posts/from-zero-day-to-zero-hour-how-ai-compresses-the-vulnerability-lifecycle-5dcwvg44s twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: From Zero-Day to Zero-Hour: How AI Compresses the Vulnerability Lifecycle | daily.dev og:description: AI has collapsed the traditional vulnerability lifecycle from months to hours. Anthropic's Claude Mythos Preview found thousands of zero-day vulnerabilities... og:url: https://daily.dev/posts/from-zero-day-to-zero-hour-how-ai-compresses-the-vulnerability-lifecycle-5dcwvg44s og:image: https://api.daily.dev/og/posts/5DCWVG44S.png og:image:alt: From Zero-Day to Zero-Hour: How AI Compresses the Vulnerability Lifecycle og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # From Zero-Day to Zero-Hour: How AI Compresses the Vulnerability Lifecycle **[Security Boulevard](https://daily.dev/sources/securityboulevard)** · 13 min read · 1 upvotes · 0 comments ## Summary AI has collapsed the traditional vulnerability lifecycle from months to hours. Anthropic's Claude Mythos Preview found thousands of zero-day vulnerabilities across major OSes and browsers in weeks, producing 181 working Firefox exploits. CrowdStrike's 2026 data shows attacker breakout times averaging 29 minutes, with AI-augmented attacks up 89% year-over-year. Small open models (3.6B parameters, $0.11/million tokens) can replicate these findings, democratizing attack capability. The cost per vulnerability has dropped from $20,000–$80,000 to $5–$50. Enterprises must rearchitect patch management into three tiers: same-day automated patching for low-risk systems, 72-hour targets for standard systems, and 7-day maximums for critical infrastructure. Compensating controls (RASP, WAF virtual patching, network segmentation, behavioral detection) are essential to cover the gap between disclosure and deployment. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How fast can AI models like Claude Mythos discover and exploit vulnerabilities compared to human researchers? AI models can discover vulnerabilities and build working exploits within hours to days, versus the traditional four to twelve month human research and patch cycle. A roughly $20,000 compute budget running for hours can replace months of specialized security research, and Claude Mythos Preview reportedly found thousands of zero-days across major operating systems and browsers in weeks. _Track how fast AI is reshaping vulnerability discovery and patch timelines by following security coverage on daily.dev._ ### What was CrowdStrike's reported average eCrime breakout time in the 2026 Global Threat Report? CrowdStrike reported an average eCrime breakout time of 29 minutes, down from 48 minutes the year prior, a roughly 65% increase in attacker speed moving from initial access to lateral movement. The fastest observed breakout was 27 seconds, and one intrusion saw data exfiltration begin within four minutes of initial access. _Security teams benchmarking response speed against attacker breakout times can follow threat-report analysis on daily.dev._ ### Can small, cheap AI models find the same security vulnerabilities as large frontier models? Yes, independent testing by AISLE found 8 out of 8 small models detected Mythos's flagship exploit, including a 3.6 billion parameter model costing $0.11 per million tokens that found a FreeBSD exploit, and a 5.1 billion parameter open model that recovered the analysis chain for a 27-year-old OpenBSD bug. On some basic security reasoning tasks, small open models even outperformed larger frontier models. _Anyone weighing which AI model to trust for security scanning can compare capability claims on daily.dev._ ## Similar posts on daily.dev - [The Vulnerability Curve Bent With the AI Curve — ProjectDiscovery Blog](https://daily.dev/posts/the-vulnerability-curve-bent-with-the-ai-curve-projectdiscovery-blog-6crwmllob) · ProjectDiscovery Blog · 0 upvotes · 0 comments - [What Zero-Day Response Should Be in the Post-Mythos Era](https://daily.dev/posts/what-zero-day-response-should-be-in-the-post-mythos-era-sy5pwxui7) · BleepingComputer · 0 upvotes · 0 comments - [As AI enables bad actors, how are 3,000\+ teams responding?](https://daily.dev/posts/as-ai-enables-bad-actors-how-are-3-000-teams-responding--m4s2fauu7) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-security](https://daily.dev/tags/ai-security), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/from-zero-day-to-zero-hour-how-ai-compresses-the-vulnerability-lifecycle-5dcwvg44s) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"From Zero-Day to Zero-Hour: How AI Compresses the Vulnerability Lifecycle","url":"https://daily.dev/posts/from-zero-day-to-zero-hour-how-ai-compresses-the-vulnerability-lifecycle-5dcwvg44s","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/from-zero-day-to-zero-hour-how-ai-compresses-the-vulnerability-lifecycle-5dcwvg44s"},"datePublished":"2026-07-10T05:47:36.320Z","dateModified":"2026-09-14T08:55:58.762Z","description":"AI has collapsed the traditional vulnerability lifecycle from months to hours. Anthropic's Claude Mythos Preview found thousands of zero-day vulnerabilities...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/39dee248e4684d76cf041edca973e3c0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/39dee248e4684d76cf041edca973e3c0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Security Boulevard","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Security Boulevard","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3613c832180040de8d85bb29f74395be","url":"https://daily.dev/sources/securityboulevard"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/from-zero-day-to-zero-hour-how-ai-compresses-the-vulnerability-lifecycle-5dcwvg44s","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-security,zero-day","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Boulevard","item":"https://daily.dev/sources/securityboulevard"},{"@type":"ListItem","position":3,"name":"From Zero-Day to Zero-Hour: How AI Compresses the Vulnerability Lifecycle"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/from-zero-day-to-zero-hour-how-ai-compresses-the-vulnerability-lifecycle-5dcwvg44s#faq","mainEntity":[{"@type":"Question","name":"How fast can AI models like Claude Mythos discover and exploit vulnerabilities compared to human researchers?","acceptedAnswer":{"@type":"Answer","text":"AI models can discover vulnerabilities and build working exploits within hours to days, versus the traditional four to twelve month human research and patch cycle. A roughly $20,000 compute budget running for hours can replace months of specialized security research, and Claude Mythos Preview reportedly found thousands of zero-days across major operating systems and browsers in weeks. Track how fast AI is reshaping vulnerability discovery and patch timelines by following security coverage on daily.dev."}},{"@type":"Question","name":"What was CrowdStrike's reported average eCrime breakout time in the 2026 Global Threat Report?","acceptedAnswer":{"@type":"Answer","text":"CrowdStrike reported an average eCrime breakout time of 29 minutes, down from 48 minutes the year prior, a roughly 65% increase in attacker speed moving from initial access to lateral movement. The fastest observed breakout was 27 seconds, and one intrusion saw data exfiltration begin within four minutes of initial access. Security teams benchmarking response speed against attacker breakout times can follow threat-report analysis on daily.dev."}},{"@type":"Question","name":"Can small, cheap AI models find the same security vulnerabilities as large frontier models?","acceptedAnswer":{"@type":"Answer","text":"Yes, independent testing by AISLE found 8 out of 8 small models detected Mythos's flagship exploit, including a 3.6 billion parameter model costing $0.11 per million tokens that found a FreeBSD exploit, and a 5.1 billion parameter open model that recovered the analysis chain for a 27-year-old OpenBSD bug. On some basic security reasoning tasks, small open models even outperformed larger frontier models. Anyone weighing which AI model to trust for security scanning can compare capability claims on daily.dev."}}]} ```