AI BUILDS EXPLOITS FROM PATCHES IN HOURS

Anthropic's security team conducted experiments using its Mythos Preview AI model to assess how quickly artificial intelligence could weaponize publicly disclosed security patches. The findings are stark: the model successfully created eight complete attack chains before Microsoft's automatic updates reached a single device. The study focused on critical vulnerabilities in Firefox and the Windows kernel. In each case, the AI translated patch information into functional exploits with minimal resources. The entire process cost only a few thousand dollars and required no advanced technical expertise to initiate. This capability represents a significant departure from historical security timelines. Patches have traditionally provided organizations a window of days or weeks to deploy fixes before adversaries could develop reliable exploits. The AI's speed compresses that window to hours. Anthropicargues the findings demonstrate that the current patch management rhythm—built around human-speed vulnerability research and exploit development—is fundamentally obsolete. Organizations typically rely on a predictable timeline: vulnerability disclosure, patch release, gradual deployment, then exploit availability. Each stage has historically allowed time for defensive responses. The research carries implications across enterprise security, government infrastructure, and critical systems. Patch deployment strategies that assume multi-day windows may leave systems vulnerable to AI-accelerated exploitation. The practical security gap between patch release and full organizational deployment has effectively narrowed to hours rather than days. Anthropicstop short of recommending specific defenses but emphasizes that existing patch management practices require reevaluation. The study suggests security teams must accelerate deployment timelines and consider alternative protective measures that do not rely on patch exclusivity windows. The findings align with broader industry concerns about AI-assisted cybersecurity acceleration. Other research has demonstrated AI capabilities in reconnaissance, social engineering, and malware development, but Anthropic's study specifically quantifies the compression of exploit development cycles—a metric that directly impacts defensive timelines.