Palo Alto Networks' Unit 42 built NOVA, an autonomous multi-agent, multi-model AI system for vulnerability discovery. In two months, NOVA scanned 3,915 open-source projects and found 14,090 previously unknown vulnerabilities — 99.4% unreported, with 40% rated high or critical severity. Unlike traditional fuzzers that focus on memory corruption, 92% of NOVA's findings were semantic and logic flaws like access control bypasses, path traversal, SSRF, and code injection. The system uses an ensemble of frontier AI models, each finding distinct vulnerabilities others miss. Results also revealed 5,421 supply-chain exposures across dependency ecosystems. The research highlights a collapsed patch window: AI compresses discovery timelines dramatically, meaning attackers can reverse-engineer patches and develop exploits faster than ever. Palo Alto Networks is responding with Advanced Virtual Patching, delivering network-level protections within hours of discovery, and partnering with clearinghouses like Project Lightwell for responsible disclosure.
