AI tools compressing software exploit timelines

Palo Alto Networks' Unit 42 is investigating an agentic cyberattack that exploited 50 vulnerabilities within a single organization in 10 hours, work that would traditionally take weeks. Chinese state-backed hackers more than doubled their attack volume after integrating DeepSeek into malware development and reconnaissance. Automated agents began probing an OCaml project for vulnerabilities within about ten minutes of a patch being shared for discussion. A METR analysis found that reported vulnerability rates for major projects, including cURL, OpenSSL, Firefox, and Microsoft, dramatically accelerated in 2026 compared with 2025, with the same pattern visible in aggregate databases including the US NVD and OSV. The authors characterize the shift as a 'phase change' in AI capability for cybersecurity in 2026, analogous to what occurred for coding in 2025. rclone maintainer Nick Craig-Wood reported over 40 security disclosures in a single month, against roughly 20 across the project's first ten years combined, with about 75% containing a genuine issue. GitHub CVE assignment times have ballooned from 2-3 days to 3-4 weeks, forcing maintainers to ship releases with 'CVE-PENDING' in changelogs. Russian-speaking hackers allegedly used the Cursor coding tool to breach a Belgian chemical company and at least six other firms. CrowdStrike and Okta both raised earnings forecasts citing increased AI-driven threats.