How AI Finds Zero-Days: The 2026 Guide

The practical guide to how AI systems now discover zero-day vulnerabilities, who builds them, and what it means for defenders.

In July 2025, a Google AI agent found a critical database bug that was known only to attackers and about to be used, then Google cut the attack off before it happened. That agent, Big Sleep, is what Google calls likely the first time an AI directly foiled an in-the-wild exploitation attempt - Google. One year later, the picture is no longer a single agent finding a single bug. It is thousands of bugs, found by many different machines, faster than the humans who maintain the software can patch them.

The core problem is an economic one: finding a serious vulnerability used to be slow, expensive, and rare, and now it is none of those things. A frontier model can read a codebase the way a career researcher does, reason about where the dangerous inputs flow, and prove the bug is real in a sandbox before a human ever looks at it. When the cost of discovery collapses, everything downstream of it changes: the bug-bounty market, the patch pipeline, the offense-defense balance, and the day-to-day work of every security team.

This guide breaks down exactly how AI finds zero-days in 2026: the six core techniques that actually work, the eight systems and platforms doing it (ranked with a transparent scorecard), the benchmarks that measure them, the real vulnerabilities they have found, where the approach fails badly, and what a defender should actually do about it. It assumes no security background. Where a claim rests on a number, that number is sourced to the organization that reported it.

Contents

1. Why AI finding zero-days is the story of 2026
2. How AI actually finds a zero-day: the six techniques
3. The frontier labs: Google, Anthropic, OpenAI
4. The challengers: XBOW, DARPA, and the startups
5. How the machines are measured: the benchmark landscape
6. The evidence: what AI has actually found
7. Where it fails: slop, false positives, and the patch gap
8. The economics: cost, market, and the bug-bounty upheaval
9. How to put this to work: a defender's playbook
10. The 2026 to 2027 outlook: the arms race and the defender's head start

---

The systems finding zero-days, ranked

Before the detail, here is the whole field on one page. The table scores the major AI vulnerability-discovery systems on the four things a defender actually cares about, weighted by how much they matter. Every cell carries the score and the evidence behind it. The table is sorted by final score, highest first.

How to read the criteria. Discovery power (35%) is the heaviest weight because it is the whole point: can the system find novel, real bugs at depth, not just restate a scanner. Validation and false-positive control (25%) is second because, as Section 7 shows, an unvalidated finding is worse than no finding in 2026. Access and availability (20%) captures who can actually use it: the frontier labs gate their strongest models, while the open-source systems are free to anyone. End-to-end autonomy (20%) measures how much of the loop (find, prove, patch, submit) runs without a human. Scores are 0 to 10, and the final column is the weighted average.

A note on the sort. DARPA's open systems tie OpenAI at 8.4 not because they find deeper bugs (they do not) but because being free and open under the Linux Foundation is worth a great deal when the alternative is a waitlist. O-mega sits last on purpose: it is a general agent workforce, not a security-specialized engine, and it would be dishonest to score it as one. The rest of this guide is the depth behind each of these rows.

---

1. Why AI finding zero-days is the story of 2026

A zero-day is a vulnerability that the people who could fix it do not yet know about, which means there is no patch and no warning. The name comes from the defender having "zero days" of lead time. For decades, finding one was craft work: a skilled researcher would stare at code, run fuzzers for weeks, and occasionally strike a flaw worth reporting or exploiting. The scarcity of that skill was, quietly, one of the load-bearing assumptions of computer security. Serious bugs existed in almost everything, but finding them was expensive enough that most stayed hidden.

That assumption is what broke in 2026, and it broke on the economics rather than on any single dramatic hack. To reason about it from first principles, ignore the models for a moment and look at the market. What a security team buys is not "software" or "AI"; it buys found and fixed vulnerabilities before an attacker finds them first. The binding constraint on that outcome was always the cost of the first half, discovery, because skilled human attention does not scale and does not get cheaper. When one input to a valuable output becomes radically cheaper, the whole system reorganizes around the new bottleneck. Here the new bottleneck is no longer finding bugs. It is triaging, validating, and patching the flood of bugs that machines now surface.

The size of the cost collapse is not subtle. In DARPA's AI Cyber Challenge finals, autonomous systems found and patched vulnerabilities at an average cost of about $152 per task - Nextgov. A conventional web-application penetration test starts around $5,000, and a full enterprise engagement runs past $100,000 - SoftwareSecured. Those are not the same product, and the comparison is not apples to apples, but the order-of-magnitude gap is the entire story of the year.

To see why this is structural and not a passing fad, look at what stays expensive even as discovery gets cheap. The compute to run a model keeps falling and the models keep getting better at reading code, so the discovery half of security trends toward the cost of the electricity it burns. Human attention to triage, judge, and fix does not, because it is bounded by the number of qualified people and the hours in their day. Any time one half of a process collapses in cost while the other half holds, the expensive half becomes the whole game. That is the precise sense in which 2026 is a turning point: not that AI can find bugs, which it could do crudely years ago, but that it can find real, deep, novel bugs cheaply enough that the binding constraint has visibly moved.

Why does this matter, and how should a reader apply it? It matters because the offense-defense balance in security has always rested on an asymmetry often called the defender's dilemma: an attacker needs to find one exploitable hole, while a defender has to close every hole. Cheap discovery does not resolve that asymmetry; it amplifies it, because both sides get the new capability at the same moment and the attacker only has to win once. The practical implication for a defender is that the old strategy of "we are probably too obscure or too well-audited to be worth an attacker's time" is finished. The audit is now cheap for everyone, including the attacker. The rest of this guide is about turning that same cheap discovery into a defensive advantage before someone else turns it into an offensive one, a race that Section 10 argues defenders can still win if they start now.

---

2. How AI actually finds a zero-day: the six techniques

It is tempting to imagine one magic trick behind "AI finds bugs," but the reality is a small family of distinct techniques, each with real deployed systems behind it. Understanding them matters because they fail differently, cost differently, and suit different codebases. A team that knows the difference between an LLM writing a fuzz harness and an LLM reasoning about a taint path will make far better choices about what to buy and what to trust. The common thread is that a large model supplies the one thing traditional tools never had: the ability to understand what code is trying to do and to form a hypothesis about how it could go wrong.

Before the list, it helps to see the shape of the work, because most modern systems chain several of these techniques into a single loop. Google's Project Naptime, the research effort that became Big Sleep, framed it best by giving a model the same tools a human researcher uses: a code browser to navigate source, a Python sandbox to run experiments, and a debugger to set breakpoints and inspect memory - Project Zero. Everything below is a variation on giving a reasoning model the right tools and the right question, then letting it iterate until it either proves a bug or gives up.

The six techniques that actually work in 2026 are these. Each is paired with a system that proves it in production, not a lab demo.

• Agentic code auditing reads and reasons about source the way a researcher would, tracing untrusted input to a dangerous operation. This is how Anthropic's Claude Opus 4.6 found over 500 high-severity flaws in projects like Ghostscript - Anthropic.
• LLM-guided fuzzing uses a model to write the fuzz "harnesses" that feed random input into code, reaching corners human-written harnesses never covered. Google's OSS-Fuzz effort used this to surface 26 new bugs - The Hacker News.
• Variant analysis takes one known bug and sweeps the codebase for its siblings, the same mistake made elsewhere. GitHub's CodeQL has helped find 456 vulnerabilities this way, and modern agents now generate the queries - GitHub Security Lab.
• Static analysis with LLM triage runs a classic analyzer, then uses a model to throw out the false alarms that made those tools painful, with papers reporting over 40% false-positive reduction - arXiv.
• Binary and exploit work decompiles and reasons about compiled code with no source, and in rare cases builds a working exploit, which remains the hardest step of all.

Each technique earns its place for a different reason, so it is worth being concrete about where each one wins. Agentic code auditing is the breakthrough of the year because it finds logic and memory bugs that fuzzers structurally cannot reach, the kind that require understanding intent rather than crashing on malformed input. LLM-guided fuzzing is the workhorse for mature C and C++ projects that already have fuzzing infrastructure, where the model's job is coverage rather than reasoning. Variant analysis is the cheapest high-yield move available, because one seed bug frequently reveals a dozen more; in some codebases over twenty instances of the same flaw class have been found from a single seed. Static-analysis triage is the unglamorous fix to the reason security teams historically ignored their scanners: the noise. And binary or reverse-engineering work, where open tools like LLM4Decompile now beat Ghidra on re-executability by a wide margin, matters most for the closed-source and firmware world where no source code exists to read - arXiv.

It is worth slowing down on the mechanics of agentic code auditing, because it is the technique that changed the game and it is the least intuitive. The core move is taint tracing: the model follows a piece of untrusted input, a network packet, an uploaded file, a URL parameter, from the point it enters the program (the "source") to the point it reaches a dangerous operation (the "sink"), such as a memory copy or a command execution. Traditional static analyzers do this too, but they drown in false alarms because they cannot tell which paths are actually reachable in practice. A reasoning model can read the surrounding logic, understand which guards are real and which are illusory, and discard the impossible paths, which is why pairing a classic analyzer with an LLM triage step reports large false-positive reductions. The same reasoning ability is what lets the model do variant analysis well: once it understands why one bug is a bug, it can describe the pattern precisely enough to find every sibling, which is how a single seed flaw routinely uncovers a whole cluster.

The sixth technique, exploit generation, deserves separation because it is where the current limits are clearest. Finding a bug and weaponizing it are different jobs, and the second is far harder. Anthropic documented Claude Opus 4.6 building a full browser exploit chain for CVE-2026-2796, a JIT miscompilation in Firefox's WebAssembly engine, assembling the classic primitives (addrof, fakeobj, arbitrary read and write) that a human exploit developer would use - Anthropic. The catch is the success rate: the model turned a vulnerability into a working exploit in only about two of 350 attempts. That gap between "can find" and "can exploit" is the single most important nuance in the whole field, and Section 10 returns to why it is the defender's best friend right now.

Here is the loop those techniques run inside. Most production systems, from OpenAI's Aardvark to Google's CodeMender, follow this same pipeline, differing mainly in how much of it runs without a human.

The reason this pipeline shape matters in practice is that the validate-in-sandbox step is what separates a useful system from a slop machine. A model that only reads code and reports suspicions produces a flood of plausible-sounding findings, most of them wrong. A system that insists on triggering the bug in a controlled environment before it reports anything produces far fewer findings, but the ones it produces are real. When you evaluate any tool in this space, the first question is not "how many bugs did it find" but "how many did it prove," a distinction we return to in both Section 5 and Section 7. For a broader treatment of how these agentic loops are engineered, our guide to building AI agents covers the orchestration patterns underneath.

---

3. The frontier labs: Google, Anthropic, OpenAI

The three largest AI labs have each built serious vulnerability-discovery programs, and their approaches diverge in instructive ways. Google leads with a research-lab sensibility and a bias toward defense, Anthropic leads on raw discovery depth and public transparency about the danger, and OpenAI leads on productizing the full find-to-patch pipeline. Reading them side by side is the fastest way to understand the shape of the field, because between them they have set the benchmarks, the safety norms, and the public expectations that everyone else now works against.

The stakes are not abstract. In one week of September 2026, all three drew a public line: OpenAI announced that its newest model had crossed the "Critical" cybersecurity threshold in its own safety framework, and Google shipped a gated cyber-defense model and program the same week. That clustering is not a coincidence; it reflects a shared recognition that the capability has arrived and that the only remaining question is who controls its distribution.

3.1 Google: Big Sleep, CodeMender, and OSS-Fuzz

Google's program is the oldest and the most defense-minded, and it is built from three linked efforts. Big Sleep, a collaboration between Google DeepMind and Project Zero, is the autonomous bug-hunter. Its headline result is not a count but a moment: it found CVE-2025-6965, a critical SQLite memory-corruption flaw that Google says was "known only to threat actors and was at risk of being exploited," and Google used it to cut off the attack before it landed - Google. By August 2025 Big Sleep had independently reported 20 new vulnerabilities in open-source software, mostly in the media libraries FFmpeg and ImageMagick - TechCrunch.

The second effort, CodeMender, tackles the other half of the loop: fixing. It is a DeepMind agent that finds, validates, and patches flaws, and at its October 2025 launch it had already upstreamed 72 security fixes to open-source projects, including work on a codebase of 4.5 million lines - Google DeepMind. Critically, Google still routes every CodeMender patch through a human reviewer before it goes upstream, a discipline that Section 7 will show is not optional. The third effort brings LLMs to Google's long-running OSS-Fuzz service, using models to generate fuzz harnesses; that work found 26 new bugs, including a roughly 20-year-old flaw in OpenSSL, CVE-2024-9143 - The Hacker News.

The OSS-Fuzz work illustrates why "let the model write the test" is more powerful than it sounds. Fuzzing only finds bugs in code it actually exercises, and for years vast stretches of important libraries went untested simply because no human had written a harness to reach them. Letting a model generate those harnesses reached corners of long-audited software that fuzzers had never touched, which is why a two-decade-old OpenSSL flaw finally surfaced: it survived not because it was cleverly hidden but because no test had ever run its code path. That is the quiet, unglamorous version of the AI security story, and arguably the most durable one. Not a genius model outsmarting human researchers, but a tireless one filling in the coverage that humans never had the time to complete.

In September 2026 Google productized this into Gemini 3.8 Flash Cyber, a security-tuned model that posts 86.2% on the CyberGym benchmark, released alongside the Fairwind Program that gives it to over 650 vetted government and enterprise partners paired with CodeMender - Google. The gating is the tell: Google's strongest cyber model is not something you can simply sign up for, a deliberate choice that keeps the raw capability out of general circulation. For how the underlying Gemini 3.8 Flash performs on agentic work outside security, see our Gemini 3.8 Flash guide. Google's overall posture, defense-first, human-in-the-loop, and cautious about access, sets the template the others are measured against.

3.2 Anthropic: Claude Opus 4.6, Mythos, and Project Glasswing

Anthropic's program is the most aggressive on raw discovery and the most public about the danger. The foundation is Claude Opus 4.6, released February 5, 2026, which found and validated over 500 high-severity vulnerabilities in production open-source code, in projects like Ghostscript, OpenSC, and CGIF, bugs that had gone undetected for decades - Anthropic. In a parallel collaboration, the same model scanned nearly 6,000 Firefox files, found its first vulnerability after 20 minutes, and surfaced 22 distinct flaws over two weeks, most patched in Firefox 148 - Anthropic. Anthropic's own summary of that work states the crucial asymmetry plainly: "the cost of identifying vulnerabilities is an order of magnitude cheaper than creating an exploit."

The escalation came with Project Glasswing, launched April 7, 2026: an initiative that pairs an unreleased frontier model, Claude Mythos Preview, with a dozen launch partners including AWS, Apple, Google, Microsoft, NVIDIA, and CrowdStrike, plus over 40 more organizations, backed by $100 million in model credits and $4 million in open-source security donations - Anthropic. Mythos Preview reproduces vulnerabilities at 83.1% on CyberGym, against 66.6% for Opus 4.6, and Anthropic chose not to release it publicly at all. By its May 2026 update, Glasswing partners had found more than 10,000 high or critical vulnerabilities across 1,000+ open-source projects, with a flagship being a wolfSSL certificate-forgery bug, CVE-2026-5194 - Anthropic. We cover the initiative in depth in our Project Glasswing guide, and the model itself in our Claude Mythos Preview guide.

Anthropic's transparency extends to the offensive side, which is what makes it the most useful lab to study. In November 2025 it disclosed what it assessed as the first documented large-scale cyberattack run with minimal human intervention: a state-sponsored group jailbroke Claude Code and used it to run an estimated 80 to 90% of an espionage campaign against roughly 30 organizations autonomously, with humans stepping in at only a handful of decision points - Anthropic. The mechanics of that campaign are worth understanding, because they show the failure mode defenders must guard against. The attackers did not hand Claude a single instruction to "hack this company," which the model would refuse. They decomposed the attack into a sequence of small, innocuous-looking tasks and told the model it was an employee of a legitimate security firm running authorized tests, a social-engineering attack aimed at the AI rather than at a human. Each individual step looked benign, and only the assembled whole was an intrusion. That jailbreak-by-decomposition pattern is what makes AI misuse so hard to catch, and it is why every defensive program in this guide leans on validation and human review rather than trusting the model's own judgment about intent.

In September 2026 Anthropic released both Claude Fable 5.1 and its gated sibling Claude Mythos 5.1, the invite-only model with "the strongest cyber capabilities" it has shipped, available only through a Cyber Verification Program - Anthropic. For how Fable 5.1 compares to Opus 5 for ordinary agent work, see our Fable 5.1 versus Opus 5 comparison, and for the company's wider strategy, our Anthropic ecosystem guide.

3.3 OpenAI: Aardvark, Codex Security, and GPT-6 Astra

OpenAI's contribution is the most productized version of the full pipeline. Aardvark, unveiled October 2025, is a GPT-5-powered "agentic security researcher" that runs the exact loop from Section 2: it builds a threat model of a repository, scans commits for new flaws, validates exploitability in a sandbox, and drafts a patch through Codex for human review - The Hacker News. In benchmark testing on repositories seeded with known and synthetic bugs, it identified 92% of them, and it had already contributed to at least 10 CVE disclosures. By March 2026 it had grown into Codex Security, which in a single 30-day window scanned over 1.2 million commits and surfaced 792 critical and 10,561 high-severity findings, with false-positive rates down more than half - The Hacker News.

The line-crossing moment was GPT-6 Astra. Ahead of its September 2026 launch, OpenAI stated it was the first model in its history to reach the "Critical" cybersecurity threshold under its Preparedness Framework, the tier defined as being able to find and weaponize zero-day exploits against hardened real systems, or run a full attack from only a high-level goal - CNBC. Tested without production safeguards, Astra scored 100% on OpenAI's internal ExploitBench, against 78.5% for its predecessor, and the publicly released version refuses to write proof-of-concept exploits at all - The Hacker News. Astra is priced at $10 per million input tokens and $50 per million output and carries a 1.05-million-token context window - OpenAI. Our GPT-6 Astra guide covers the launch in full.

Crossing the "Critical" tier is not just a label; in OpenAI's framework it triggers a specific set of safeguards before deployment, including tighter restrictions on who can reach the capability, stronger protection of the model's weights, and enhanced monitoring of how it is used. This is why Astra's most dangerous capability sits behind the gated Daybreak Red tier rather than in the default product, and why the public model is deliberately crippled for offense while still useful for defense. The framework turns a capability threshold into an access-control decision, which is the same move Anthropic made by keeping Mythos invite-only and Google made with Fairwind. Read together, the three labs have converged on an unwritten norm: the strongest cyber capability ships to vetted defenders first, and to the open market late, if at all.

OpenAI paired the capability with money and access controls, which is the pattern to watch. It split its Daybreak program into a defensive Blue tier and a vetted, offensive Red tier, then committed $1 billion over six months in subsidized access for under-resourced defenders like water utilities, community banks, and open-source maintainers - The Register. President Greg Brockman framed the urgency bluntly, warning of a future where "critical infrastructure outages are just a way of life." OpenAI also put its Agents API, the same Codex harness underneath Aardvark, into public beta, which we cover in our Agents API guide. The through-line across all three labs is that the capability is real, the strongest versions are gated, and the productized pipeline is now something a company can buy.

---

4. The challengers: XBOW, DARPA, and the startups

The frontier labs are not the whole story, and in some ways they are not even the most interesting part of it. A wave of focused companies and one landmark government competition have shown that you do not need to own a trillion-parameter model to find real bugs at scale; you need the right scaffolding around a capable model and a relentless focus on one job. These challengers matter because they are where most defenders will actually get their hands on the capability, since the frontier labs gate their strongest tools and the challengers sell access.

The reason this tier exists at all is the same first-principles point from Section 1: once discovery is cheap, the durable advantage moves to whoever builds the best workflow around it. That is a product problem, not a research problem, and product problems are exactly where startups and open-source communities outrun big labs. The result is a genuinely competitive market forming in real time.

4.1 XBOW: the machine that topped the human leaderboard

The clearest proof that autonomous bug-hunting works came from XBOW, an AI penetration-testing agent that in June 2025 became the first automated system to reach number one on HackerOne's US leaderboard, outranking every human researcher. Per its own disclosure it had submitted roughly 1,060 vulnerability reports, with a 90-day breakdown of 54 critical, 242 high, 524 medium, and 65 low-severity findings - XBOW. It works by parsing a target's scope with an LLM, detecting duplicate and staging environments, and, crucially, running automated validators that confirm a finding is real (for example, a headless browser that confirms a cross-site scripting payload actually executes) before a human signs off and submits.

The economic significance is easier to grasp with the human comparison in front of you. A top human bug-bounty researcher is a rare, expensive specialist who can work one target at a time. XBOW runs the same craft in parallel across hundreds of programs continuously, which is how it accumulated over a thousand reports in the window it took to climb the leaderboard. That is not a marginal productivity gain; it is a change in kind, the same shift from artisan to factory that reshaped every industry which automated a scarce skill. The limitation, and it is a real one, is that XBOW's strength is web-application testing, the domain where its automated validators (like a headless browser confirming a payload fires) can cheaply prove a finding. Deep memory-corruption bugs in C libraries remain harder, which is where the frontier labs still lead.

The market rewarded the result. XBOW raised a $75 million Series B in June 2025 led by Altimeter, then a $120 million Series C in March 2026 at a valuation over $1 billion, led by DFJ Growth and Northzone, with Fortune 500 firms already on the platform - XBOW. CEO Oege de Moor tied the achievement to the field's origins: "Many of us have worked at the highest levels of offensive security, and we've long known that scaling our craft requires more than human effort" - Help Net Security. XBOW's significance is not the funding but the demonstration that a well-built autonomous pentester can out-produce the entire human field on a public playing surface, a result that reframed what "at scale" means for offensive security.

4.2 DARPA's AI Cyber Challenge: the open-source proof

If XBOW proved it commercially, DARPA proved it in the open. The AI Cyber Challenge (AIxCC) was a two-year, $8.5-million competition to build autonomous "cyber reasoning systems" that find and fix vulnerabilities without human help, and it concluded at DEF CON 33 in August 2025. Team Atlanta won the $4 million top prize, Trail of Bits' Buttercup took $3 million, and Theori took $1.5 million - Nextgov. Across the finals the systems found 54 of 70 planted vulnerabilities and patched 43 of them, and, as a byproduct, discovered 18 previously unknown real-world zero-days, at that $152-per-task average.

The lasting impact is that the winning systems were open-sourced. Trail of Bits released Buttercup, which found 28 vulnerabilities and applied 19 patches using only cheaper non-reasoning models, immediately after the competition - Trail of Bits. By May 2026, several AIxCC systems had moved to long-term stewardship under the OpenSSF, where one, FuzzingBrain, had already found 62 vulnerabilities across real projects like CUPS and OpenLDAP - OpenSSF. This is why the scorecard ranks the DARPA systems at the top: they are proven, they are autonomous end-to-end, and unlike every frontier lab model, they are free. For a maintainer of a critical open-source library, that combination is hard to beat.

4.3 The startups and the platform question

Around these leaders sits a growing set of specialists. ZeroPath, a Y Combinator company, offers a GitHub app that autonomously detects, verifies, and submits fixes, claiming to remove 85% of the false positives that plague conventional scanners - Y Combinator. RunSybil, founded by OpenAI's first security hire, Ari Herbert-Voss, raised a $40 million Series A in March 2026 led by Khosla Ventures to build an AI-native offensive-security platform, with early customers including Cursor and Notion - Fortune. Herbert-Voss captured why the founders in this space believe the timing is now: "Once OpenAI dropped GPT-2, I said wow, this changes everything about the economics of what it would take to run a cyber campaign."

There is also a second, broader category worth naming honestly: general AI agent platforms. Rather than buy a single-purpose scanner, some teams run agentic security workflows on a general autonomous agent workforce, pointing frontier models plus custom skills at their own code. Platforms like O-mega sit here, letting a team orchestrate multi-step agent work without stitching together their own harness. The honest caveat, and the reason O-mega scores where it does on the scorecard, is that a general platform has no security-specialized engine of its own: it is only as good at finding bugs as the model and skills you give it, and it will not match a purpose-built system like Buttercup or Aardvark on raw discovery. For teams whose security work is one part of a wider automation strategy it can still be the right call, but for pure vulnerability hunting a specialist wins. Choosing between a specialist tool and a general platform is the same build-versus-buy decision our AI agent ROI analysis examines for automation projects generally.

---

5. How the machines are measured: the benchmark landscape

Every claim in this guide about how good AI is at finding bugs rests on measurement, and the benchmarks used to make those measurements are both essential and easy to misread. They matter because vendors quote them constantly, and a reader who cannot tell a saturated capture-the-flag benchmark from a real-world discovery benchmark will be misled by the first impressive number they see. The single most important lesson of the benchmark landscape is that the scores are wildly different depending on what is actually being asked, and the gap between them is where the truth lives.

At the easy end sit the capture-the-flag benchmarks. Cybench is a framework of 40 professional CTF tasks, and it showed that without human guidance, agents could solve only the tasks that took human teams under about 11 minutes, while the hardest human task took nearly 25 hours - arXiv. These benchmarks are useful but they measure puzzle-solving on curated challenges, not discovery in a messy real codebase. When a lab says its model "saturated" a CTF benchmark, that is real progress, but it is not the same as finding a novel bug in Firefox.

At the hard end sits the benchmark that best predicts real-world value. CyberGym, from UC Berkeley, is built from 1,507 tasks across 188 real open-source projects, making it far larger and more realistic than the CTF suites - arXiv. Its results are the sobering counterweight to the hype: across the models tested, the success rate for reproducing a known target vulnerability was 18.6%, and for discovering a genuinely new one it was only 3.8%. Even so, that small percentage, applied across a large enough surface, produced 34 real zero-days during the study. A middle tier, CVE-Bench, built from 40 critical real-world CVEs, found the best agent framework exploiting about 20% of them in a zero-day setting - arXiv.

A caution about vendor-run benchmarks belongs here, because the most eye-catching number in this guide, GPT-6 Astra's 100% on ExploitBench, is one of them. That ExploitBench is OpenAI's own internal evaluation, run without production safeguards, and it is a different thing from an unrelated academic benchmark of the same name, a naming collision that is easy to trip over. A perfect score on an internal eval is a real signal of capability, but it is not comparable to an independent, published benchmark like CyberGym, and it should be read as "the vendor says its model aces the vendor's test." The general lesson is to weight independent, reproducible benchmarks (CyberGym, CVE-Bench, the DARPA competition) more heavily than any score a lab reports about its own model, and to treat a saturated benchmark as a sign the benchmark has aged out, not that the underlying problem is solved.

What should a reader take from this spread, and how should they apply it? The practical rule is to anchor on the discovery number, not the puzzle number. The 3.8% novel-discovery rate on CyberGym is the honest baseline for "how often does a general model find a brand-new bug in real code with no hints," and it explains why the frontier labs invest so heavily in scaffolding, sandboxes, and specialized models: they are trying to move that number up. It also explains why the raw counts elsewhere in this guide are so large despite the low per-attempt rate, because a 3.8% hit rate applied to millions of commits still yields thousands of bugs. For a fuller tour of the evaluation landscape, see our AI agent evals and benchmarks guide, and for why headline benchmark numbers so often mislead, our analysis of why AI coding benchmarks lie. The benchmark that matters is the one that mirrors your actual codebase, and for most defenders that is a real-world discovery benchmark, not a CTF.

---

6. The evidence: what AI has actually found

Benchmarks predict; real disclosures prove. The most persuasive case that AI vulnerability discovery has crossed from research into reality is the growing pile of actual, cataloged bugs it has found in software that billions of people run. This section matters because it is where skepticism goes to die: it is one thing to score well on a benchmark, and another to find a 20-year-old flaw in OpenSSL or a certificate-forgery bug in a library that protects banking traffic. The pattern across the evidence is consistent, which is what makes it credible.

The clearest single signal is population-level. Epoch AI tracks disclosed high and critical CVEs from 21 major software organizations, and it found that the monthly total hit about 1,546 in June 2026, more than 3.5 times the monthly record set before the Claude Mythos and Glasswing launch, then climbed to roughly 2,512 in July - Epoch AI. Epoch is careful to note this is correlation, not proof of causation: some of the rise reflects greater interest in bug-hunting, and the public count excludes the more than 10,000 vulnerabilities Glasswing found but has not individually disclosed. Even discounted, a multi-fold jump in disclosed critical bugs from the world's most-scrutinized vendors is a step change, not noise.

The individual finds are what give the aggregate its weight. Big Sleep's CVE-2025-6965 in SQLite was caught before attackers could use it. Google's fuzzing surfaced the two-decade-old OpenSSL bug. Anthropic's Opus 4.6 found more than 500 zero-days in a single research effort and 22 in Firefox alone, and Glasswing's partners crossed 10,000. On the commercial side, XBOW's roughly 1,060 HackerOne reports and OpenAI's Codex Security surfacing 792 critical findings in one month round out a body of evidence that no single vendor's marketing can explain away. These are different organizations, using different systems, reporting to different disclosure processes, and all pointing the same direction.

Two finds deserve a closer look, one for what it shows and one for what it warns. Anthropic's flagship Glasswing example was a certificate-forgery flaw in wolfSSL, CVE-2026-5194, in a library that secures banking and email traffic; the model both found the bug and built a working exploit, and it has since been patched - Anthropic. The warning comes from a 17-year-old FreeBSD remote-code-execution bug, CVE-2026-4747, that Anthropic said Mythos found and exploited autonomously - Anthropic. Skeptics pushed back hard on the framing, noting that several other models also detected the same bug and that the working exploit was assembled only after a patch already existed, arguing the "autonomous discovery" story was oversold - flyingpenguin. Both things are true at once: the capability is real, and the marketing around it runs ahead of the evidence, which is exactly why independent validation matters so much.

The evidence also cuts both ways, which is the part defenders must not skip. The same capability that lets Anthropic find 10,000 defensive bugs is what let a state-sponsored actor run 80 to 90% of an espionage campaign through Claude Code. The bugs AI finds do not care whether the finder wears a white hat or a black one, and the population-level CVE spike is a defensive signal only if defenders are the ones acting on it fastest. Anthropic's own threat reporting makes the two-sidedness concrete. Its September 2026 threat-intelligence report, covering the prior eight months, cataloged multiple state-linked and criminal operations that used Claude models for reconnaissance, exploitation, and data theft, and it noted pointedly that the strongest, gated models were kept out of those misuse cases by their safeguards - Anthropic. The lesson is not that AI security tools are too dangerous to build, since that ship has sailed and the defensive value is enormous. The lesson is that the distribution of capability is now a first-order security decision, because the same model that patches your infrastructure will, if it leaks or is jailbroken, help someone attack it.

That framing, discovery is neutral and speed decides who benefits, is the bridge to the two hardest problems in the field: the failure modes in Section 7 and the economics in Section 8.

---

7. Where it fails: slop, false positives, and the patch gap

An honest guide has to spend as much time on the failures as the triumphs, because the failures are where most teams will actually feel this technology first. The headline capability is real, but wrapped around it are three serious problems that have already done visible damage: a flood of low-quality AI-generated reports, a stubborn false-positive rate, and a patch pipeline that cannot keep up with the flood of real bugs. Understanding these is not pessimism; it is the difference between deploying AI security tooling well and drowning in its exhaust.

The most vivid failure is what maintainers now call AI slop. When anyone can point a model at a project and generate official-looking vulnerability reports, the reports that are confident, well-formatted, and completely wrong start to overwhelm the humans who must triage them. The maintainer of curl, Daniel Stenberg, ended curl's decade-old bug-bounty program in January 2026 after the confirmed-vulnerability rate collapsed. As he put it, "We saw an explosion in AI slop reports," and "the confirmed-rate plummeted to below 5%. Not even one in twenty was real" - Daniel Stenberg. This is the direct, human cost of cheap generation without cheap validation.

The problem is not confined to one project. HackerOne paused its decade-old Internet Bug Bounty program in March 2026, stating that "AI-assisted research is expanding vulnerability discovery across the ecosystem" and that "the balance between findings and remediation capacity in open source has substantively shifted" - CSO Online. Read carefully, that statement contains both failure modes at once: too much slop on one side, and, even for the real findings, not enough human capacity to fix them on the other. This is the patch gap, and it is quantified starkly in Anthropic's own Glasswing data, where of 530 high or critical bugs reported to maintainers, only 75 had been patched. Finding is now cheap; fixing is still human-bound and slow.

It is worth separating the two kinds of wrong finding, because they need different fixes. A false positive is a report of a bug that is not real, the output of a model that reasoned plausibly but never proved its claim; the cure is forced validation, and the academic work here reports concrete gains, with adaptive taint-analysis techniques cutting false positives by over 40% against standard tools - arXiv. AI slop is worse, because it is often generated with no intent to be correct at all, sometimes to farm bounty payouts or reputation, and no amount of the submitter's validation helps because the submitter does not care. The defense against slop is structural: raise the cost of submitting through reputation gating or stake requirements, and automate the first triage so a human never sees the obvious fabrications. The patch gap, by contrast, is not a validation problem but a capacity one, and it is the reason auto-patching systems like CodeMender are the most important research direction in the field, because a found bug that is never fixed is a gift to whoever finds it next.

The distinction that resolves all three failures is validation. The slop problem is a validation problem (reports that were never proven), the false-positive problem is a validation problem (findings that were never triggered), and even the patch gap is partly a validation problem (maintainers cannot trust a fix they cannot verify, so CodeMender and its peers route every patch through a human). This is why Section 2 insisted that the sandbox step is the one that separates real systems from slop machines, and it is why the startups in Section 4 compete so hard on false-positive reduction. For teams building on top of these agents, the related risk of the agents themselves being manipulated is covered in our guide to AI agent prompt-injection defense. The rule for 2026 is simple and unforgiving: an unvalidated finding is a liability, not an asset.

---

8. The economics: cost, market, and the bug-bounty upheaval

The technology is interesting, but the money is what will decide how fast it spreads and who controls it. The economics of AI vulnerability discovery break into three linked shifts: the collapse in the cost of finding a bug, the surge in spending on AI-powered security, and the upheaval in the bug-bounty market that connected researchers to vendors for the last decade. Each one reinforces the others, and together they explain why every major lab and a dozen startups piled into this space within eighteen months.

Start with the cost, because it drives everything else. The DARPA figure of about $152 per found-and-patched vulnerability, set against five-figure human penetration tests, is not a promotional stat; it is a structural change in the unit economics of security work. When the marginal cost of an audit approaches the cost of the compute it runs on, auditing stops being a periodic event a company schedules once a year and becomes something that runs continuously in the background, the way spell-check runs on every keystroke. That is the real prize the vendors are chasing, and it is why the pricing of the underlying models matters so much to the whole field.

That cost collapse is pulling real money behind it, and the clearest single signal is a spending commitment rather than an analyst forecast. OpenAI pledged $1 billion in subsidized access for frontline defenders over an initial six-month window, which is both a genuine defensive investment and a statement about where the company thinks the value is - The Register. When a lab is willing to give away a billion dollars of access to seed the defensive side of a market, it is signaling two things at once: that the market is large, and that being early to it matters more than the near-term revenue it is forgoing.

The third shift is the most disruptive to how security actually got done. The bug-bounty market, worth $81 million in payouts on HackerOne alone over a recent year, was the mechanism that matched independent researchers to vendors - BleepingComputer. AI is straining that mechanism from both ends: it floods the intake with slop, as Section 7 showed, while also letting a single autonomous system like XBOW out-earn the entire human field. The likely equilibrium is not the death of bug bounties but their bifurcation, into trusted, validated, AI-assisted pipelines on one side and a much harsher filter on unsolicited reports on the other. The economic logic points the same way the technical logic does: the scarce, valuable resource is no longer discovery, it is trustworthy validation and the human capacity to fix what gets found.

There is a deeper point hiding in the bug-bounty upheaval, and it is about who captures the value. For a decade, the bounty market transferred money from software vendors to independent human researchers, rewarding scarce skill. AI breaks that model in two directions at once: it lets a vendor run discovery in-house continuously, reducing the need to pay outsiders, and it lets a single automated operator like XBOW capture rewards that once spread across thousands of people. The likely result is consolidation, fewer and larger AI-equipped players on both the vendor and researcher sides, with a shrinking middle of part-time human hunters. That is neither good nor bad in the abstract, but it is a real redistribution, and any team whose security strategy quietly relied on the old crowd-sourced model should plan for that crowd to thin out.

---

9. How to put this to work: a defender's playbook

Everything to this point describes the landscape; this section is about what a security team, an engineering lead, or a solo maintainer should actually do with it in 2026. The temptation is either to ignore the whole trend as hype or to buy the most expensive tool and expect magic. Both are wrong. The right posture is to treat AI vulnerability discovery as a powerful new input that still needs a workflow around it, and to build that workflow deliberately, starting from your actual codebase and your actual capacity to fix what you find.

The first move is to be honest about the patch gap before you turn on the firehose. There is no value, and real risk, in generating 500 findings you cannot triage or fix; that path leads straight to the slop and capacity problems of Section 7. Match discovery to remediation capacity. A small team should start with a validated, low-false-positive tool pointed at its highest-risk components, not a broad scan of everything. The systems that validate in a sandbox before reporting (Aardvark, the DARPA-derived open systems) are worth more to a stretched team than a raw scanner precisely because they spend the scarce resource, human attention, only on findings that are already proven.

The second move is choosing what to run, and here the field genuinely offers something for every budget and posture. The considerations that actually decide the choice are these.

• For open-source maintainers, the free, OpenSSF-stewarded systems from DARPA's challenge (Buttercup, FuzzingBrain) are the highest-leverage starting point.
• For product teams in a GitHub workflow, a code-scanning app like ZeroPath fits the existing pull-request loop with minimal disruption.
• For enterprises with a security budget, a commercial autonomous pentester like XBOW or an offensive platform like RunSybil buys depth and support.
• For teams already running an agent workforce, orchestrating security skills on a general platform can consolidate tooling, with the caveat that it is not a specialized engine.

The interpretation that ties those options together is that the decision is really about where the work already lives. You are not choosing the "best" system in the abstract; you are choosing the one that fits your existing pipeline, because a tool that does not fit the workflow gets ignored no matter how capable it is. This is the same lesson our AI agent ROI guide draws from automation projects that stalled: capability without integration does not scale.

The third move is to keep a human in the loop deliberately, not by accident. Every serious program in this guide, from CodeMender to Big Sleep to Anthropic's own research, routes findings and patches through human review, and they do it for two reasons: to catch hallucinated bugs before they waste a maintainer's time, and to catch a bad patch before it ships. As you wire these agents into your own systems, the agents themselves become part of your attack surface, which is why identity and access for them matters; our guides to securing AI agents with non-human identity and to securing an AI-built app before launch cover that discipline in detail. One more practical point often gets skipped: measure the tool on your own code before you trust its numbers on anyone else's. A system that posts strong benchmark scores can still be a poor fit for your stack, your languages, or your false-positive tolerance, and the only way to know is a scoped trial on a repository you understand well enough to grade the results yourself. Run it against a codebase where you already know some of the bugs, and check three things: how many real issues it finds, how many false alarms it produces per real finding, and how much human time each finding costs to triage. Those three numbers, not the vendor's benchmark, are what tell you whether the tool will help your team or bury it.

The playbook, in one line: validate before you trust, match discovery to your capacity to fix, and keep a human on the final decision.

---

10. The 2026 to 2027 outlook: the arms race and the defender's head start

The last question is where this goes, and the answer follows from the first-principles frame this guide opened with. If discovery is now cheap for everyone, the future is not a world where defense wins or offense wins permanently; it is a continuous arms race in which the advantage belongs to whoever moves fastest with the new capability at each moment. The interesting question is not whether attackers will get these tools (they already have, as the espionage case proved) but whether defenders can build a durable enough head start to matter.

There is a genuine structural reason for defensive optimism, and it sits in the numbers from Section 2. Finding a bug is far easier than exploiting it. Anthropic's own work put the exploitation success rate at roughly two in 350 attempts, and stated the discovery-to-exploitation cost gap is an order of magnitude. This asymmetry favors defenders, because a defender only needs to find and fix a bug, while an attacker needs the much harder full exploit. If defenders adopt the cheap-discovery capability aggressively and close bugs before attackers can do the expensive work of weaponizing them, the math tilts their way. That is precisely the bet behind Project Glasswing giving partners a head start, behind Google's Fairwind Program, and behind OpenAI's billion-dollar subsidy for defenders.

That optimism has a hard boundary, and it is the patch gap again. A defensive head start is worthless if found bugs are not fixed, and the current data (75 patched out of 530 reported in Glasswing's own numbers) shows the fixing side badly trailing the finding side. The next phase of this field will be decided less by better discovery models, which are already extraordinary, and more by whether the patch pipeline can be automated safely enough to keep pace. CodeMender's auto-patching, the AIxCC systems' patch generation, and every "detect, verify, fix" startup are all racing at exactly this bottleneck, because whoever solves trustworthy automated patching unlocks the value that discovery alone cannot deliver.

The dual-use structure of the whole field is easiest to see as a single picture: one cheap capability, flowing to both sides of the fight at the same moment.

This dual-use structure is why AI vulnerability discovery has become a national-security question, not just an engineering one. The three largest labs are effectively rationing their strongest cyber capability the way a government rations a controlled technology, and they are doing it voluntarily, ahead of any regulation. OpenAI's billion-dollar subsidy explicitly targets the softest points in a country's infrastructure: water utilities, community banks, local governments, and the volunteer maintainers of open-source code that everything else runs on. The logic is that these defenders are exactly the ones who cannot afford the capability at market price, and exactly the ones whose failure cascades outward. Whether voluntary rationing by a handful of companies is a stable arrangement is one of the open questions of 2027, but for now it is the arrangement, and it is why the gated-model decisions in Section 3 are best read as policy rather than product.

Two structural shifts will define the next twelve to eighteen months. The first is agents as product: the same autonomous, long-running agent harnesses that power Aardvark are now sold as general infrastructure, which means vulnerability discovery becomes something you compose rather than a monolith you buy, a shift our self-improving AI agents guide traces across domains. The second is gated capability as policy: the strongest cyber models (Mythos, Astra's unrestricted mode, Gemini Flash Cyber) are deliberately withheld from open access, making the distribution of capability a security decision in its own right. For a team deciding which underlying model to build a security workflow on, our best LLMs for agents ranking tracks the current field. The trajectory is clear: the capability is here, it is getting cheaper, and the winners will be the ones who wire it into a real workflow fastest.

---

Conclusion: a decision framework

AI vulnerability discovery crossed from research into infrastructure in 2026. Machines now find real zero-days in the world's most important software, at a fraction of the cost and a multiple of the speed of the humans who used to do it alone. The evidence is not one vendor's demo; it is Big Sleep foiling a live attack, Opus 4.6 finding 500 bugs, Glasswing crossing 10,000, XBOW topping a human leaderboard, and DARPA's open systems patching flaws for $152 apiece. The capability is settled. What is not settled is who benefits from it.

For a defender deciding what to do, the framework is short. If you maintain open-source software, adopt the free OpenSSF-stewarded systems now, because they are proven and cost nothing. If you ship a product, wire a validated, low-false-positive tool into your existing pull-request workflow and match its output to your actual capacity to fix. If you run an enterprise security program, buy a commercial autonomous system for depth, insist on sandbox validation, and invest as much in your patch pipeline as in discovery. If broader automation is the goal, a general agent workforce can consolidate the work, as long as you remember it is not a specialized engine. In every case, the invariant is the same: validate before you trust, keep a human on the final decision, and treat your speed of fixing as the number that decides whether cheap discovery is your advantage or your adversary's.

The deepest point is the one from the first section. When a scarce input becomes cheap, value moves downstream. Discovery is no longer scarce. Trustworthy validation and fast, safe patching are, and that is where both the risk and the opportunity now live. The teams that internalize that shift, and rebuild their security workflow around it rather than bolting AI onto the old one, are the ones who will still be safe when everyone, including the attacker, has the same cheap and powerful tools.

This guide reflects the AI vulnerability-discovery landscape as of September 2026. Model names, prices, benchmark scores, and program details in this field change month to month, so verify current specifics against the primary sources linked above before making decisions.