YEMPIK / STUDIOSoftware, projects and training.
All articles
Type
Point of view
Topic
Security
Published
Reading time
7 min read

From patch to attack. The weeks are now hours.

When a vendor publishes a security fix, it also tells everyone where the flaw was. For years companies had weeks before anyone turned that hint into an attack. In 2026 an AI model does it in a few hours, for a few thousand dollars. What changed, what happened in October, and what has to change in how a company decides when to update.

By, AI Architect & Co-Founder, Yempik
In this article
In summary
  • In Anthropic’s tests an AI model turned published fixes into working attacks: the first crash in 31 minutes, the first Firefox exploit in under an hour.
  • A full attack on Windows, starting from the fix, cost about 2,000 dollars in API credits on average.
  • Italy’s National Cybersecurity Agency counts 54% more new vulnerabilities in the first half of 2026, likely because of frontier AI models.
  • In 2025 Italy suffered 9.6% of the serious incidents Clusit recorded worldwide, and 16% of those against manufacturing.
  • Update policy has to be written in hours for exposed systems, and it has to go into supplier contracts.

Thirty-one minutes

A security fix is also a map. Comparing it with the previous version shows which line changed, and so where the flaw was. For years that comparison took weeks of work by rare specialists, and those weeks were the time companies had to update.

In June Anthropic’s research team measured how long it takes today. It gave Claude Mythos Preview, a model the company does not release to the public, 21 Windows kernel fixes published in January and February. The model reproduced the flaw in 18 cases: the first after 31 minutes, all within six hours. In 8 cases it built a full attack, up to control of the whole system, at an average cost of about 2,000 dollars each. On Firefox the first working attack arrived in under an hour.

Anthropic itself sums up the report: exploiting an already-fixed flaw now takes a few thousand dollars and API access. In April, the company wrote, more than 99% of the vulnerabilities the model had found were still unpatched.

The first 12 hours after a fix is published
See the data as a table
MeasureTime
Until the first reproduced crash, Windows31 min
Until the first working exploit, Firefox< 1 h
Until the last of 18 crashes, Windows6 h
Until the last of 8 exploits, Firefox~12 h
Before an exposed cloud workload is attacked, on average5.3 h
An AI model reads the fix, works out what it repairs and builds the attack for anyone who has not installed it yet. The times are lab measurements on reachable systems: a real attack still has to reach yours. Anthropic Frontier Red Team, June 2026 · Microsoft Digital Defense Report 2026.

The same models work for the other side too. Mozilla fixed 271 vulnerabilities found with Mythos in Firefox 150, and Anthropic opened access to major software vendors and maintainers through Project Glasswing. In Italy the National Cybersecurity Agency recorded 37,032 new vulnerabilities in the first half of 2026, 54% more, and likely attributes it to frontier models. More flaws are found, faster, on both sides.

The Economist@TheEconomist · weekly

…the time between a vulnerability being identified and being weaponised has shrunk from a number of years to just a few hours…

Open on X
SANS Institute@SANSInstitute · security training and research

“The window between discovery and weaponization has collapsed into hours.”

Open on X

October, day by day

On 20 October Oracle published 1,295 security fixes in a single day. On the 21st it added an out-of-band alert for Java: a vulnerability scored 9.1 out of 10, exploitable remotely without credentials. Java runs in many ERP systems, portals and invoicing tools. A company that updates once a month can stay exposed for up to four weeks.

On the 22nd Capcom reported that on the 19th it had detected unauthorized access to its accounts: 11,774,247 email addresses with login data, and 196 passwords changed by someone else. It did not say how they got in.

On the 19th, Reuters and the researchers at NorForge described a single attacker who used AI agents to launch more than a thousand attack projects against websites and breached about a hundred companies. How much data left, Reuters could not establish. The researchers estimate about 50 dollars per successful breach. It is an estimate, but it is enough to change the maths: an attack that costs 50 dollars is worth it even against a small company.

  1. 02GitHub closes a flaw in npm package publishing. GitHub
  2. 05Eight malicious npm packages from one operator, active since 2023. Checkmarx
  3. 08DDoS attack on Italy’s foreign ministry, attributed by sources to NoName057(16). Systems hold. ANSA
  4. 08The tensorlake npm package ships malware that writes coding-agent configuration. StepSecurity
  5. 13The npm flaw goes public: more than 1,500 packages exposed. Help Net Security
  6. 17OpenCode: a breach hits 1.4% of its console users; OpenAI refunds the credits. Fortune
  7. 19One attacker with AI agents: more than 1,100 attack projects, about 100 companies breached according to Reuters. NorForge
  8. 20Oracle ships 1,295 security fixes in one day. Oracle
  9. 21Out-of-band Java alert: remotely exploitable without credentials, score 9.1. Oracle
  10. 21LiteLLM 1.107.0 compromised on PyPI and Docker. LiteLLM
  11. 22Capcom reports unauthorized access: 11,774,247 email addresses and login data, 196 passwords changed. Capcom
Twenty-two days, eleven events, each with its source. Days with two events carry a dot.
dax@thdxr · OpenCode co-founder

…we basically need agents going 24/7 because that’s what they have

Open on X

Why Italy too

On 8 October Italy’s foreign ministry website suffered a DDoS attack attributed, according to ANSA, to the pro-Russian group NoName057(16). The systems held. It is the visible part of a wider picture.

According to the Clusit 2026 report, in 2025 Italy suffered 9.6% of the serious incidents recorded worldwide: 507, 42% more than the year before. 12.6% hit manufacturing, and 16% of all incidents against manufacturing worldwide hit Italian companies. In the first half of 2026 manufacturing is also the sector most hit by ransomware, according to the ACN.

For an Italian manufacturer the question is no longer whether anyone wants to attack it. It is how long it takes to notice, and how long it takes to close the door.

What changes for the people who decide

Microsoft’s 2026 Digital Defense Report puts the average time before an exposed cloud workload is attacked at 5.3 hours. An update policy written in weeks no longer holds. Five decisions that belong to management, not only to IT:

For the last point we made Yempik Security Audit public: agents that read your code looking for where it breaks, and a second agent that tries to disprove every problem before the report.

  1. 01

    Know what is exposed to the internet, today.

    An up-to-date list of the systems reachable from outside: websites, portals, ERP, remote access. Without a list, no priority makes sense.

  2. 02

    Write a maximum time, in hours, for critical fixes on exposed systems.

    And measure it. A rule nobody checks is a wish.

  3. 03

    Put the same time into supplier contracts.

    If a supplier updates your ERP, their reaction time is yours.

  4. 04

    Decide who decides at night and at the weekend.

    Fixes come out when they come out. The Java alert arrived the day after 1,295 fixes.

  5. 05

    Read your own code before the people who want to attack it do.

    The same models that build attacks find the flaws. Use them first, on software that is yours.

Questions

What is a patch, and why does it help attackers too?

It is the fix for a flaw, published by the vendor. Comparing it with the previous version shows where the flaw was: anyone who has not updated stays exposed exactly there. An AI model now makes that comparison and builds the attack in a few hours.

Can anyone use Claude Mythos to attack?

No. Anthropic does not release Mythos Preview to the public: access is limited to vendors and maintainers of critical software through Project Glasswing. But October’s reports show attackers using other available models and AI agents, with real results.

We are a small company. Why would anyone attack us?

Because automated attacks do not choose: they try everything they can reach. According to the NorForge researchers’ estimates, a successful attack with AI agents cost about 50 dollars. At that price a small target is worth it.

How often should we update?

It depends on what is exposed. Systems reachable from the internet need a maximum time in hours for critical fixes; internal ones can follow a longer cycle. New versions are installed after a check, not automatically: October also brought poisoned updates.

Sources

  1. [1]Anthropic Frontier Red Team: Measuring LLMs’ impact on N-day exploits (8 June 2026). red.anthropic.com
  2. [2]Anthropic Frontier Red Team: Claude Mythos Preview cyber assessment (7 April 2026). red.anthropic.com
  3. [3]Anthropic: Project Glasswing. www.anthropic.com
  4. [4]Mozilla: The zero-days are numbered (21 April 2026). blog.mozilla.org
  5. [5]ACN: Operational Summary, first half of 2026. www.acn.gov.it
  6. [6]Clusit: figures from the Clusit 2026 Report (11 March 2026). clusit.it
  7. [7]Microsoft Digital Defense Report 2026. www.microsoft.com
  8. [8]Oracle: Security Alert CVE-2026-91403 (21 October 2026). www.oracle.com
  9. [9]Oracle: Critical Patch Update, October 2026. www.oracle.com
  10. [10]Capcom: notice of unauthorized access to CAPCOM ID (22 October 2026). www.capcom.co.jp
  11. [11]Reuters: one hacker, AI agents and a few thousand dollars (19 October 2026). www.reuters.com
  12. [12]NorForge: Inside Cairn (19 October 2026). norforge.com
  13. [13]ANSA: cyber attack on the Italian foreign ministry (8 October 2026). www.ansa.it
Transparency note

Yempik works with AI models, including Anthropic’s, and made the audit tool mentioned here public. Mythos timings are Anthropic’s lab measurements; NorForge’s cost per breach is an estimate and is labelled as such.

Read your code before the people who want to attack it do.

Yempik Security Audit looks for where your software breaks and hands you one page to decide what to fix, and how fast.

See the audit
Back to all articles

See also

The AI supply chain is the new perimeterLiteLLM, npm and coding agents.The vibe coder’s quoteYou pay for the cheapest quote later.Yempik Security AuditIt finds the vulnerabilities, then tries to disprove them.
From patch to attack: the weeks you had to update are now hours | Yempik