Can AI fix software vulnerabilities as fast as it exploits them?
Core argument: Average time between a vulnerability's initial publication and its first confirmed exploitation fell below 100 days in 2025, with median times to exploitation already falling to zero days, and some attacks occur before patches become available.
Even before Mythos and GPT 5.5 came along in 2026, companies and governments had to react with increasing speed once a vulnerability is disclosed. The number of reported vulnerabilities has been rising, of which 1.5% -2.0% get exploited each year [and] the time between initial publication of a given vulnerability and its first confirmed exploitation (TTE) declined to less than 100 days on average in 2025, with median times to exploitation already falling to zero days. In fact, some attacks are occurring even before patches become available. The most important epiphany is the following: the same tools that are used to detect and exploit vulnerabilities can also be used to propose code fixes and remediate them. Claude Security, GPT 5.5-Cyber and OpenAI’s Codex Security Plugin are notable examples.


