a16z: AI Cut Exploit Writing to Hours as Attacks Now Land 7 Days Before Disclosure
a16z · x · 2026-11-05
a16z's Asaf Ezra and Steph Zhang analyze how AI reshaped attack economics: average exploitation moved from 63 days after disclosure (2018-19) to 7 days before it in 2025; a working exploit went from a skilled person's month to hours of machine time; median time to fully fix known-exploited bugs rose to 43 days. They expect a long, expensive worm era hitting hardest where systems can't update fast — hospitals, schools, small water systems. "When attacking is nearly free, attackers no longer need to want a target."
Key points
- Exploit writing, the 20-year bottleneck of cyberattacks, is now nearly free thanks to AI
- Historical chart: lines crossed 2021; Log4Shell exploited 5 days pre-patch, later cases (PaperCut, PHP2Shell) before disclosure
- Patching speed hasn't kept up, widening the exposure window
More from Safety
- Swiss AI Safety Days doubles to two days with Russell and Bengio keynotes — maksym_andr · 2026-11-06
- OpenAI researcher: an AI security 'race to the top' is driving CVE disclosures — Eric_Wallace_ · 2026-11-06
- AI ethics researcher claims lab insiders coldly weigh catastrophe deaths against 'abundance' — LuizaJarovsky · 2026-11-06
- Firecracker VM escape disclosed: researchers claim root execution on the host — moyix · 2026-11-06
- Mustafa Suleyman flags 'deeply concerning' Delaware proposal for AI-run companies — mustafasuleyman · 2026-11-06
- Hugging Face open-sources safeagents, a local proxy that blocks reward-hacking tool calls — yb2698 · 2026-11-06