87% of exploited bugs are attacked on disclosure day, up from 23% in 2020, as AI collapses the patch window
cyb3rops · x · 2026-09-07
Security researcher matrosov cites a16z data showing the window to patch software bugs is collapsing: 87% of bugs hackers actually exploit are now attacked on or before the day they become public, versus 23% in 2020.
His core argument:
- Legacy appsec was built for a threat model where humans had days to think: pre-generated heuristics (rules, SAT/SMT solvers) or fuzzing harnesses found issues, humans understood the problem first, defined a fix path, then scaled remediation.
- AI-driven attacks remove that luxury—discovery and remediation must now happen almost simultaneously.
- Pointing AI agents at existing security tools doesn't fix this; ineffective mitigations neither stop AI attackers nor buy time.
The takeaway: AI is breaking the foundational assumption of application security, and defenses need to operate at machine speed.
More from AGI Musings
- "The world will change unbelievably fast once intelligence itself starts scaling" — Dr_Singularity · 2026-10-23
- Why short-timeliners should expect tens-of-billions AI lab acquisitions, not technical evals — herbiebradley · 2026-10-23
- Frontend dev left holding two senior backend jobs after company bet on Claude Code — ParticularFan1122 · 2026-10-23
- Grady Booch revives Weinberg's 1971 quip: software so buggy one woodpecker could destroy civilization — Grady_Booch · 2026-10-23
- Why Netflix keeps losing to YouTube: UGC platforms professionalize easier than pro platforms go casual — ZeroStateReflex · 2026-10-23
- AI killed the coding moat: indie devs now compete on demand and distribution — sven_ai · 2026-10-23