AI is Finding the Holes….Very Quickly

AI tools are now finding software flaws faster than vendors can fix them, and attackers have the same tools. For anyone running federal or business systems, the window between “vulnerability found” and “vulnerability exploited” has nearly closed.

The Story – AI Finds the Holes

For years, discovering a new software vulnerability took a skilled researcher weeks or months of painstaking work. That is no longer true. In late 2024, Google’s “Big Sleep” AI agent found a previously unknown memory-safety flaw in SQLite, one of the most widely used database engines in the world, and in 2025 the same project flagged a SQLite bug that attackers were preparing to use before they could use it. At DARPA’s AI Cyber Challenge finals in August 2025, autonomous systems combed through millions of lines of open-source code and found 18 real, previously unknown vulnerabilities on their own. AI-driven tools now regularly rank among the top performers on commercial bug bounty platforms.

That is good news for defenders, but the same capability is available to the other side. In November 2025, Anthropic reported that a state-sponsored group had used its AI model to carry out most of a cyber espionage campaign against roughly 30 organizations, with the AI handling reconnaissance, vulnerability discovery and exploit code at a pace no human team could match. Criminal groups are following the same playbook. The result is a flood of newly discovered flaws, many in software that has run quietly for a decade or more, and attackers who can turn a published vulnerability into a working exploit in hours instead of weeks.

Patch Fast, or Pull the Plug

The old rhythm of a monthly patch cycle, with exceptions granted for “critical business systems,” cannot keep up. When a vulnerability is known to be exploited, every day it stays open is a day an automated tool can find and use it. The federal government has already moved in this direction. CISA’s Binding Operational Directive 22-01 requires agencies to fix vulnerabilities on its Known Exploited Vulnerabilities list within set deadlines, often two weeks. When fixes weren’t possible in time, CISA has gone further: in 2024 it ordered agencies to disconnect Ivanti Connect Secure VPN appliances, and in 2025 it directed agencies to take certain Cisco firewall devices offline rather than leave them exposed.

That is the right model for every organization. Identified vulnerabilities should be patched very quickly, measured in days, not quarters. If a system can’t be patched, because the vendor hasn’t released a fix, the software is end-of-life, or the change would break a critical application, it should be isolated or taken offline until it can be remediated. A system that is down for a week is an inconvenience. A system that is breached can mean lost data, a long recovery and a reportable incident.

What We Recommend

At InfoStructures, we help our federal customers turn this into routine practice: keep an accurate inventory of every system and the software on it, scan continuously, prioritize anything on the CISA KEV list, test and deploy patches on a short, defined clock, and document a “disconnect plan” for systems that can’t be patched in time. Compensating controls such as network segmentation, web application firewalls and endpoint detection buy time, but they don’t replace the fix.

AI has changed how quickly flaws are found. It needs to change how quickly they get fixed, too. How fast does your organization patch today? If the answer is “it depends,” it’s time to talk.