Frontier models now turn public patches into working exploits, shrinking the patch gap. Teams shipping or operating software should speed up patch deployment.
Key takeaways · AI-distilled
N-day exploits use the patch itself as a roadmap: attackers diff patched and unpatched code to find the bug. Historically this was slow, with WannaCry arriving 59 days after MS17-010 and 16 of 25 bugs in Mandiant's 2020 study taking a month or more.
Across 18 recent Firefox SpiderMonkey patches, Claude Mythos Preview autonomously built 8 working code-execution exploits; on 21 Windows kernel patches without source code, it produced 8 full chains escalating a low-privilege user to SYSTEM.
Anthropic says its public models, with safeguards turned off, can also build N-day exploits, though fewer than Mythos Preview, and urges defenders to shorten patch deployment.
Firefox is close to a best case for defenders, with automatic updates and a 19-day median patch-to-release gap for the studied bugs, so Anthropic argues most other software's patch gaps are also wide enough to exploit.
Terms in this piece · Glossary
eval — A repeatable test for AI quality — a set of tasks plus scoring — used the way software teams use test suites, because model output is too variable to judge by eyeballing.
LLM — A large language model — the neural network behind tools like Claude and ChatGPT, trained on huge amounts of text to predict what comes next.
