AI Agents Turn Vulnerabilities Into Attacks in Hours, Not Weeks
Source: a16z
A single operator using cheap open-weight AI agents weaponized two 4-day-old security flaws against a print-management server and compromised 395 organizations in 48 countries within 26 seconds of deployment. The incident shows that automated exploit generation has collapsed the traditional patch window from weeks to hours. When PHP vulnerabilities leaked ahead of patches, exploit attempts were already probing Amazon's honeypots 4 days before disclosure. This erases the assumption of delay that underpins current security SLAs and patch timelines. Organizations relying on coordinated disclosure and staged rollouts now face an adversary model where the bottleneck has shifted from technical exploitation to initial access and scale, inverting security defense strategies built on time for remediation.