The Patch Window Is Closing: AI-Found Bugs Are Exploited in Hours

The Moment Everything Changed

On the evening of 1 October, a honeypot run by VulnCheck lit up with an attacker in China probing real, vulnerable servers for a flaw that had been public for barely a day. Five days later, another honeypot network recorded exploitation attempts against a critical Atlassian bug within two hours of a researcher publishing a working proof of concept. Neither event would have been remarkable in isolation, but together they describe a security world in which the time defenders have to react is no longer measured in weeks. This week the industry got a clear look at how short that window has become.

Background

For two decades, the working assumption of enterprise security has been that vulnerability management is a race the defender can usually win. A bug is disclosed, a vendor ships a patch, and administrators apply it during the next maintenance cycle, often within weeks or months. Attackers needed time to reverse-engineer a patch or write an exploit, and that delay gave defenders a buffer. Patch-to-exploit times have been shrinking for years, but the buffer still existed for most organisations.

AI-assisted vulnerability research is now attacking the other end of that pipeline. Anthropic launched Project Glasswing in April 2026, giving a vetted group of organisations access to its restricted Mythos model for defensive work, and ERP Today reported the programme expanding to roughly 150 more organisations across critical-infrastructure sectors. Security-industry coverage of the programme says partners have reported more than 10,000 high- or critical-severity flaws from early deployments. Anthropic itself has said that finding flaws is no longer the hardest part, and that the bottleneck has shifted to disclosure, verification and patching.

What Happened

The first case is CVE-2026-61500, an authentication bypass in the Rejetto HTTP File Server. Horizon3 researcher Zach Hanley used Mythos, accessed through Glasswing, to analyse the software. The flaw lets an attacker recover the state of the pseudo-random generator used to sign session cookies, and then forge a valid administrator session. According to The Register, Hanley said the finding “speaks to Mythos’s capabilities in understanding of mathematics”, and that Mythos did not merely flag the weak generator in isolation but connected it to a separate code path that leaked its outputs. Rejetto had already shipped a fix in version 3.2.1, but Horizon3’s detailed write-up arrived on 30 September, and VulnCheck’s Patrick Garrity reported detecting exploitation the next evening.

The second case is CVE-2026-21589, a critical unauthenticated file-access flaw affecting eight self-managed Atlassian products, including Jira, Confluence, Bitbucket and Crowd. Atlassian published its advisory on 5 October, and watchTowr then released a technical analysis and public proof of concept. BleepingComputer quoted Previdian’s Ryan Dewhurst saying exploitation attempts began “within two hours” of that publication. A scanning template for the open-source Nuclei tool followed soon after, which made automated hunting for vulnerable servers far easier. Previdian expects the activity to grow over the coming days and weeks.

A third data point came from Google. On 1 October the company paused submissions to its Open Source Software Vulnerability Rewards Program, citing, as Infosecurity Magazine reported, “a significant rise in automated submissions, the vast majority of which are not valid.” The pause runs until at least the first quarter of 2027. It shows the same shift from the other side, since discovery has become cheap enough to flood the people who have to verify and fix what is found.

Why It Matters

It is worth being precise about what this week proves and what it does not. Neither exploitation wave was caused by an AI model attacking anyone; in both cases human attackers acted on public disclosures. The HFS flaw had been patched for months before the write-up appeared, so the real failure there was unpatched servers still reachable from the internet. The Atlassian activity was, so far, mostly probing observed on honeypots rather than confirmed breaches.

The significance is in the trend line. When a model can find a subtle cryptographic weakness and chain it with a separate information leak, the supply of high-quality vulnerabilities rises sharply. When public write-ups and proofs of concept appear in the same news cycle as advisories, attackers can act almost immediately. The cost of finding bugs is falling quickly, while the cost of fixing them, which involves maintainers, change control and downtime, is not.

That asymmetry is the heart of the problem for ordinary organisations. A company that patches monthly was reasonably safe when exploits took weeks to appear, and is not safe when they appear in hours. Self-hosted collaboration tools, file servers and edge appliances are especially exposed because they sit on the internet and hold credentials for other systems. This week’s pattern also played out around a maximum-severity SonicWall appliance flaw that attackers began probing days after a patch, which suggests the Atlassian case is not an outlier.

Expert Perspectives

The researchers closest to these incidents are cautious about the headline but blunt about the operational lesson. Hanley’s own framing of the HFS discovery was about capability rather than alarm: Mythos understood the mathematics well enough to turn two separate weaknesses into one working attack. Garrity of VulnCheck, tracking the response, described seeing “our canaries” detect “an actor in China targeting real vulnerable hosts in the US”, and has been maintaining a running count of vulnerabilities attributed to Mythos and Glasswing. By The Register’s account, that tally had reached 286 CVEs, of which this was only the second known to be exploited in the wild.

On the Atlassian side, watchTowr’s Yordan Ganchev told eSecurityPlanet that the bug “allows unauthenticated attackers to retrieve sensitive files within the webroot directory through a single request”, and that organisations running any affected product on-site “should patch immediately”. He also advised extra caution for organisations using single sign-on through Crowd, since that configuration raises the stakes of a file leak. The more sceptical reading is that two exploited bugs out of hundreds is a modest base rate, and that human researchers and attackers have always raced each other on disclosure. The counterargument is that the rate matters less than the direction, and that the defender’s patching process has not sped up to match.

What to Watch

The first thing to watch is whether the share of Mythos-linked and other AI-found bugs that reach active exploitation rises from two in 286. Each additional case will strengthen the argument that disclosure practices, such as delaying detailed write-ups and proofs of concept until patch adoption is higher, need to change. Expect that debate to be uncomfortable, because researchers who publish quickly are also the ones driving awareness.

The second is how the verification bottleneck gets addressed. Google’s freeze of its open-source bounty is an early sign that existing intake channels cannot absorb machine-scale discovery, and Anthropic has since announced a cyber effort aimed at helping defenders patch what Glasswing surfaces. Whether that kind of hands-on engineering support can scale to the long tail of small open-source projects is an open question.

The third is the practical response inside companies. Teams should assume that internet-facing systems will be attacked within hours of a public proof of concept, and that means automated patching, aggressive exposure reduction and compensating controls such as web application firewall rules ready to deploy. The organisations that treat this week as a one-off will be the ones explaining a breach next quarter.