Could They Find Software Vulnerabilities Before Hackers Do?
In early 2026, a criminal group staged a mass-exploitation campaign around a zero-day vulnerability in a widely used open-source web administration tool. The flaw was a semantic logic issue rooted in a hardcoded trust assumption—the kind of bug that traditional scanners and fuzzers had little chance of finding. Google’s Threat Intelligence Group assessed with high confidence that the actor used an AI model to find the flaw and weaponize it. But Google’s own proactive AI discovery reached the same flaw first. The campaign never launched.
That episode captures the strange duality of AI in cybersecurity today. The same technology that allows defenders to find vulnerabilities at machine speed can also be used by attackers to do the same. The question is no longer whether AI agents can find software vulnerabilities before hackers do. It’s whether defenders can keep pace.
The Shift from Offense to Defense
For years, cybersecurity evaluations of AI agents focused largely on offense—whether a model could exploit a vulnerability, bypass a security control, or generate malicious code. A working exploit, after all, is a clear and measurable outcome. But a working exploit doesn’t show that an agent can make software safe. An attacker needs to exploit only one vulnerability. A defender needs to find all of them.
That imbalance is now being addressed. The CWE-bench framework, introduced in October 2026, was explicitly designed to refocus agentic security evaluation from exploitation to defense. The premise is simple: finding a vulnerability before an attacker does is fundamentally harder than exploiting one after it’s known, and it requires a different set of capabilities—reasoning about code, understanding context, and validating hypotheses without the benefit of a proof-of-concept.
How AI Agents Find Vulnerabilities
The mechanics of AI-powered vulnerability discovery are not magic. They’re a combination of orchestration, reasoning, and validation.
The Orchestration Harness
One of the most significant findings of 2026 was that the ability to discover novel vulnerabilities isn’t reserved for frontier models like Anthropic’s Mythos. Research published on the APNIC blog demonstrated that commercial models like Opus 4.6 and Sonnet 4.6, as well as open-weight models like Z.AI‘s GLM 5.1, could replicate frontier findings when paired with the right orchestration harness.
The key is the harness—a framework that structures the discovery process as a finite-state machine. A central Orchestrator agent acts as a strategic router, dispatching specialized agents based on an append-only execution journal. The Orchestrator doesn’t read the target source code itself. It relies entirely on the journal to manage the investigation, allowing each agent to begin with a fresh context window and rehydrate from disk.
The workflow follows a simple discipline: hypothesize statically, validate by execution. A proof-of-concept is an executable harness that triggers the vulnerability, providing empirical evidence beyond static analysis.
The Cost of Discovery
This approach is token-intensive. A single run against a moderately sized codebase consumes roughly 10 million tokens on Opus or Sonnet, costing between $30 and $150 per investigation. Five runs on GLM 5.1 averaged 27 million tokens each, putting the per-investigation cost in the same range as Sonnet despite the higher volume. Truly local inference on commodity hardware remains an aspiration rather than a demonstration.
Real-World Results: TitanCA and the 100+ CVE Milestone
The most compelling evidence that AI agents can find vulnerabilities at scale comes from TitanCA, a collaborative project between Singapore Management University and GovTech Singapore. TitanCA orchestrates multiple LLM-powered agents into a unified vulnerability discovery pipeline with four modules: matching, filtering, inspection, and adaptation.
Applied to open-source software, TitanCA discovered 203 confirmed zero-day vulnerabilities and yielded 118 CVEs. The project’s authors shared key lessons from building and deploying the solution in practice, noting that while static application security testing tools have long served as the first line of defense, they suffer from high false-positive rates—a problem that agentic approaches are beginning to solve.
The Chrome Exploit: Six Days, $40,000
Perhaps the most striking demonstration of AI’s vulnerability-finding capabilities came in October 2026, when offensive security firm XBOW reported that its researchers had used OpenAI’s publicly available GPT-5.6 Sol model to build a working Chrome full-chain exploit in just six days.
The exploit combined three separate Chrome flaws: a V8 memory corruption vulnerability, a flaw in the animated WebP image decoder, and a vulnerability in Chrome’s crash-handling system. Together, they could move an attacker from code running inside a webpage to code running outside Chrome’s sandbox on Windows—meaning a victim could be compromised simply by loading a malicious webpage, without downloading a file or clicking a button.
The AI usage cost was approximately $40,000 in model compute. Google confirmed and fixed all three bugs and paid XBOW its $250,000 maximum reward for a full Chrome exploit—a payout that was the first Chrome full-chain award under the updated 2026 rules.
XBOW deliberately used a publicly available model rather than a restricted-access or purpose-built security model. The model was run as parallel agent campaigns with narrower goals: broad vulnerability search, V8 memory corruption, a V8 sandbox escape, a renderer sandbox escape, and integration of the stages. The human researchers chose the targets, reviewed the results, and decided how the pieces should fit together.
The central finding, according to the Cloud Security Alliance’s analysis, concerns price and time rather than novelty. XBOW’s first full Chrome chain took about two months to build earlier in 2026. The award-winning chain took six days. A browser exploit chain has historically been among the costliest artifacts in offensive security. A public model operated by a small, expert team has now produced one at a reported cost that is modest next to the bounty.
The Defensive Arsenal: Microsoft MDASH and Palo Alto Unit 42
The offensive capabilities of AI agents are matched by a growing defensive arsenal.
Microsoft’s MDASH (Codename MDASH) is a multi-model agentic scanning harness that orchestrates more than 100 specialized AI agents to discover real exploitable flaws, connect them to Microsoft Defender and GitHub Code Security, and help developers fix them faster. The system is designed to cut through scanner noise—the thousands of red flags that automated tools often produce—and prioritize vulnerabilities that directly cause exploitable security issues. At Build 2026, Microsoft folded MDASH into a full enterprise security control plane connecting Defender, GitHub, Agent 365, and Purview.
Palo Alto Networks’ Unit 42 Continuous Frontier AI Defense is an agentic offensive security service designed to perpetually track down and remediate vulnerabilities in gated AI capability models before attackers can weaponize them. The service includes a continuous testing engine that provides a full estate baseline scan, followed by always-on testing that adapts to changes in an organization’s environment. During internal testing, the capability found a year’s worth of exposure in just three weeks. During customer assessments, it found exposures in 100% of customers, with 37% rated high or critical in severity.
Anthropic’s Mythos and Project Glasswing
Anthropic’s entry into the space is perhaps the most closely watched. In May 2026, Anthropic launched Project Glasswing and reported that it and its approximately 50 partners had used a pre-release build—Claude Mythos Preview—to find more than ten thousand high- or critical-severity vulnerabilities in systemically important software.
The UK AI Security Institute independently evaluated Mythos Preview’s cyber capabilities. On a 32-step “The Last Ones” cyber range, Mythos Preview became the first model to complete the full scenario, and OpenAI’s GPT-5.5 the second. On expert-level tasks, GPT-5.5 completed 71.4% compared with 68.6% for Mythos Preview—a generation earlier, GPT-5.4 had achieved 52.4%. Expert-level offensive capability, at least for the evaluated tasks, is no longer hypothetical.
The Exploit Window Is Inverting
The timing dynamics of vulnerability discovery and exploitation are shifting in ways that favor attackers.
Mandiant’s M-Trends data shows that the “zero-day clock”—the time between a vulnerability’s public disclosure and the first attack—has collapsed from an average of 771 days in 2018 to mere hours today. A South Korean cybersecurity expert described the defender’s predicament bluntly: “In the past, hackers did manual work to find intrusion paths. Now, you just designate a target and the AI finds the gaps on its own. From the defender’s perspective, it’s like trying to dodge a bullet with your naked eye”.
The Chrome case illustrates this asymmetry. The exploit-building timeline of six days was faster than Google’s patch latency. The browser case shows that patch latency can be slower than the exploit-building timeline—a gap that attackers can exploit even when defenders find the flaw first.
The CodeWall Approach: Permanent Capability
London-based CodeWall launched in October 2026 with $4 million in funding to provide enterprises with autonomous AI agents that simulate external hacker attacks. The agents operate without prior credentials or inside knowledge, mimicking real-world attackers. Multiple agents, each specialized for different tasks, collaborate by logging findings to a shared investigation graph. A weakness discovered in one system becomes an entry point for another agent into connected systems and sensitive data.
Customers receive a detailed, step-by-step view of each successful attack path, complete with evidence. The agents continuously re-scan for new systems or applied fixes within authorized scopes—what founder Paul Price calls a “permanent capability” to replace traditional, infrequent penetration tests. In a demonstration, CodeWall’s agents gained unauthorized access to McKinsey & Co.’s AI platform database and exposed data at Boston Consulting Group and Bain & Co., with all firms quickly addressing the identified flaws.
What This Means for the Future
The trajectory is clear. AI agents are becoming more powerful at finding software vulnerabilities, and the cost and time required to do so are falling fast—for attackers and defenders alike. As XBOW itself noted, “The cost and time of finding serious vulnerabilities are falling fast, for attackers and defenders alike”.
Three implications follow for defenders.
First, the “exploit cost” assumption that underpins many risk models—that a browser full chain is rare and reserved for state-level actors—needs to be revisited. The economics of vulnerability discovery have changed.
Second, human expertise remains a material input. XBOW’s team chose targets, supplied examples, and decided how to assemble components. The cost curve may fall for skilled operators before it falls for novices.
Third, the benefit can accrue to both sides, but whether defenders realize their share depends on patch latency. The browser case shows that patch latency can be slower than the exploit-building timeline.
AI agents can find
software vulnerabilities before hackers do. The technology exists, the tools are deployed, and the results are measurable—203 zero-day vulnerabilities from TitanCA, ten thousand from Anthropic’s Project Glasswing, a Chrome full-chain exploit built in six days for $40,000.
But finding a vulnerability is only the first step. Patching it, validating the fix, and closing the window before attackers exploit it—those are the harder problems. The May 2026 campaign that Google’s AI discovery reached first is a reminder that the race is real, and the margin between defense and exploitation can be measured in hours, not days.
The era of manual vulnerability management is ending. What replaces it will be defined by which side—attackers or defenders—can harness AI agents more effectively, and more quickly. The tools are available. The question is who will use them first.
