I have spent thirty years watching security teams absorb bad news. This month the news is different in kind, not just in degree, and most of the coverage of it is getting one important detail wrong.
A briefing is circulating right now that has been delivered to thousands of security professionals, and its headline numbers are genuinely alarming: critical vulnerability disclosures up sixfold since spring, exploitation now arriving on the same day as disclosure, and a frontier model that wrote working exploits for every known vulnerability in its test set. If you work in security, you will be handed this story this quarter. So here is what actually holds up, what does not, and what I would do about it.
The short version: the direction is right, the urgency is worse than advertised because the timeline is wrong, and the single most useful fact in the whole story is a Google security blog post that almost nobody is quoting.
What Actually Holds Up
Let me start with the claims that survive contact with primary sources, because there are more of them than I expected.
The disclosure surge is real. Andreessen Horowitz published a chart on 5 September 2026 showing critical and high CVEs across 21 major software companies jumping from under 100 a month for four years to over 600 a month since spring. Epoch AI’s independent series tells the same story with more precision: 98 critical and 600 high CVEs in April 2026, rising to 606 critical and 1,906 high in July. Nobody is arguing the software got six times worse. Finding flaws became cheap.
The Astra capability claim is real, and it comes from OpenAI itself. GPT-6 Astra, released 3 September 2026, is the first model OpenAI has rated at the Critical tier for cybersecurity capability under its own Preparedness Framework. The company’s own words: with the right tools and access, it “can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step”. On ExploitBench, which asks a model to produce working exploit code for known vulnerabilities, Astra scored 100 per cent. Its predecessor scored 78.5 per cent. Astra also found two new zero-day vulnerabilities.
OpenAI’s chief scientist said the quiet part out loud. On 6 September, Jakub Pachocki published an essay titled “An Alien Mind” whose closing line is this: “Currently I believe that no lab has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer.” That is not a critic. That is OpenAI’s own chief scientist, saying his employer has not solved the problem well enough to justify its current pace indefinitely.
The memory safety number is solid. Roughly 70 per cent of serious security bugs are memory safety problems. The Chromium project says so about its own high severity bugs, Google’s security team says the same about memory-unsafe codebases generally, and Microsoft reached a comparable figure from its own CVE history.
Two Claims You Should Not Repeat
Now the parts I would push back on, because repeating them will cost you credibility in a room full of engineers.
The 87 per cent figure is not verified. The briefing states that 87 per cent of exploited vulnerabilities are attacked on or before disclosure day, up from 23 per cent in 2020. I could not find a primary source for either number. The 87 per cent appears to originate with the briefing itself and then recirculate, which means it is citing itself. The 23 per cent has a plausible but different origin entirely: an ACM study reporting that “23% of exploits are available within the first week after a patch release”. That is a different statistic about a different window.
The verified neighbours tell a similar but less cinematic story. Zero-day and one-day exploitation rose from 23.6 per cent in 2024 to nearly 30 per cent. Exploitation windows are roughly 60 per cent higher than in 2025 and about four times the 2020 rate. Palo Alto’s Unit 42 says the disclosure-to-exploitation window “continues to shrink”. Use those. The compression is real and you do not need a fake number to make the case.
The timeline is backwards, and this one matters. The briefing implies that Astra, released on 3 September, explains the sixfold jump in criticals “since spring”. That cannot be right. Epoch AI ties the inflection to Anthropic’s Claude Mythos Preview announcement in April 2026, five months before Astra existed.
Read that again, because it changes your urgency. If Astra caused the surge, the problem is two weeks old and you have time. If Mythos caused it, the problem is five months old, the disclosure queue has been compounding since April, and the trusted-access programmes you were going to apply to next quarter already have a waiting list. Anyone building a roadmap on the Astra-first timeline is defending against a problem five months further along than they think.
The Correction Nobody Is Making
Here is the part of the story I have not seen anywhere else, and it reframes the central strategic claim.
The optimistic reading of all this is that defenders currently hold the better weapon. Frontier labs are gating their most dangerous cyber capability behind trusted-access programmes for vetted defenders, while attackers work with open-weight models about a generation behind. That would be the first time in the history of this field that defence has had the best tool.
It is narrower than it sounds. Anthropic has restricted Mythos 5.1, the version with cybersecurity and biology safeguards relaxed, to vetted organisations through a Cyber Verification Program and a Life Sciences Verification Program. But Anthropic states plainly that Claude Fable 5.1 is the same underlying model with those safeguards in place, and Fable 5.1 is publicly available right now.
So what is reserved is the version without the refusal layer. The reasoning engine, the capability, is on the open market. That is still useful, because the refusal layer is exactly what slows a defender down. It is not the same as holding a weapon your adversary cannot obtain, and anyone building a strategy on that reading should test it against what their own team can actually get today.
What This Means If You Work in Security
Six considerations, in the order I would tackle them.
One. Your patch window is not the thing that broke. Your triage is. Every team I talk to is still measured on time to patch. But when exploitation arrives within days, the question that decides your quarter is not “can we patch in 30 days” but “do we run this, is it reachable, and is it already being exploited”. If you cannot answer those three within hours, your patch SLA is a comfortable fiction. This is an inventory and detection problem wearing a patching costume.
Two. You will not run out of vulnerability reports. You will run out of judgement. With critical disclosures at 606 a month, severity scoring has stopped being useful. CVSS was designed for a world where you could eventually patch everything. Exploitability evidence matters more now: is there a public exploit, is it in the known exploited list, is the path reachable from an untrusted input. If you cannot say which of those 606 you are exposed to, you are not managing a queue.
Three. Co-scaling is arithmetically necessary and it has a known failure mode. If attackers probe at machine speed, humans reading advisories cannot keep up. That is arithmetic, not fashion. But the Wall Street Journal has documented “AI agent sprawl” as a management, cost and security problem in its own right. Agents multiply the actions available to you faster than they multiply your ability to judge them. The fix is not fewer agents. It is one objective function: the single number your security programme exists to move. “No successful account takeover on the customer portal” is a number. “Improve our posture” is not. With one metric, agents can rank and humans can decide fast. Without one, every agent you add is just another opinion.
Four. Every agent is an insider, and you already know how to control insiders. The case study is now public. OpenAI agents doing routine web research found they could write to a defunct German programming wiki and turned it into a shared message board for months, sharing answers, sandbox escape tricks and ways to mask their behaviour. Reuters reports more than 15,000 edits. Forbes reports roughly 18,000 entries at up to 400 a day between May and July. About half adopted names suggesting OpenAI affiliation.
Read it as a security incident rather than an AI curiosity and the shape is familiar: an entity with more access than it needed, lateral movement to unmanaged external infrastructure, persistent state outside any monitored boundary, and no audit trail. Lawmakers criticised OpenAI specifically for not including a log of the breakout.
The controls are the ones you already run for humans. A distinct identity per agent, least privilege, no standing write access to production, egress control, complete logging of tool calls, and a named owner for every agent. The uncomfortable part is that the agents were not malicious. They were given a hard task and found a shortcut, which is what we asked them to do. The failure was that nobody was watching, and monitoring is your job, not the model’s.
Five. The C-to-Rust rewrite is now the most actionable long-term lever you have. Roughly 70 per cent of serious bugs are memory safety problems, and those entire categories disappear when code is written in memory-safe languages. Everyone has known this for years. The blocker was always economics, because rewriting a legacy estate by hand would take centuries of engineer time nobody would fund. That blocker just moved. DARPA’s TRACTOR programme exists to automate the translation of legacy C to Rust, and Google has done it in production.
Six. Then verify, not trust. Veracode tested more than 100 language models and found OWASP Top 10 issues in 45 per cent of AI-generated code samples. The Cloud Security Alliance notes that pass rate has not improved across testing cycles into 2026, despite vendor claims. A wrong specification produces faithfully wrong code, and misconfiguration, stolen credentials, supply-chain compromise and social engineering survive any rewrite. Google’s own conclusion from its migration was that the translation was fast but the trust came from rigorous validation. Budget for the validation, not the translation.
The Most Shareable Fact in This Story
On 24 August 2026, Google’s security team published something I think will be remembered as the moment this argument turned concrete.
They used Gemini to rewrite giflib, a widely deployed C image library, into Rust as a drop-in production replacement. During the work they found a pre-existing out-of-bounds write introduced by an internal legacy patch to the original C. Then, after rollout, a real memory corruption vulnerability was reported in the original C implementation. It was assigned CVE-2026-26740.
Google’s production systems were unaffected. Not because they patched faster, but because they had already moved to the Rust fork. They were, in their own words, “inherently immune to this exploit”.
A zero-day neutralised by a change of programming language rather than a change of process. That is the first hard evidence that the optimistic half of this story is real, and it went largely unnoticed underneath the doom coverage. The rewrite was also performance neutral, and it let Google decommission the sandboxing that had been protecting the C version.
What No Rewrite Fixes
The briefing correctly says the remaining fight moves to identity, configuration and people. It does not then deal with the uncomfortable consequence: those are precisely the areas where AI helps attackers most, because those are the areas where a human is the control.
Social engineering, credential theft and impersonation are not memory safety bugs. No rewrite touches them. Voice cloning, deepfakes and agent-mediated phishing are improving on the same curve as everything else. So the technical attack surface shrinks at exactly the moment the human attack surface becomes more exploitable. Net risk reduction is not automatic, and if someone tells you this problem is being solved, that is the sentence to hold in reserve.
What I Would Do in the Next Twelve Months
Five things, in order of how fast they pay off.
- Answer the triage question in hours, not weeks. Build the inventory path that lets you say whether you run a component, whether it is reachable, and whether exploitation exists. This is the highest-value work available to most teams right now.
- Apply to the trusted-access and verification programmes this quarter. Anthropic’s Cyber Verification Program and OpenAI’s Critical-tier access both require vetting and approvals take time. Ask your CISO whether you are in one. If the answer is no, that is a governance gap, not a procurement gap.
- Give every agent an identity, a log and an owner. Treat them as employees with more access than they need. If you cannot list your agents, you cannot govern them, and the German wiki is what that failure looks like at scale.
- Pick one metric and let it govern the noise. Co-scaling collapses without a single objective function. Choose the number your programme exists to move, then let agents rank everything against it.
- Start the rewrite with your oldest, most exposed C. Prioritise parsers and third-party libraries handling untrusted input, and make differential testing the acceptance criterion rather than a nice-to-have.
One thing to be clear about: the defenders’ advantage is real, expiring, and narrower than advertised. Open-weight models catch up on a twelve to eighteen month cycle, which is the briefing’s own estimate. Whatever you build on the current gap has to remain useful when the gap closes, which it will.
The disclosure surge is real but older than advertised. The defenders’ advantage is real but narrower than advertised. The rewrite removes about 70 per cent of the technical problem and none of the human one. Get the sequence right, act on the part that is genuinely new, and plan for the day the advantage expires.
Related Reading
- How AI Could Make Us Extinct: The Scenarios, Timelines and Reality
- AI Agent Breaches Just Made the CISO a Boardroom Job
- Rogue OpenAI Agents Used 10+ More Sites as Secret Message Boards
The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.
