In May 2026, Google’s Threat Intelligence Group confirmed a shift the industry had been bracing for. A threat actor deployed a zero-day exploit. Researchers believe an AI model built it alone. The bug was a two-factor authentication bypass, rooted in a hardcoded trust assumption. No human found it first.
Analysts caught the attack before it spread. They called it a mass exploitation event. A SOC lead reviewing the case put it to me plainly: the alert wasn’t the hard part. Knowing whether the flaw was actually reachable before the campaign hit was.
The Buffer That Used to Exist
Defensive security ran for years on one quiet assumption: attackers needed time. They had to reverse-engineer a patch, find a reliable trigger, and write exploit code that actually worked. That took weeks, sometimes months. VulnCheck data placed the median time-to-exploitation at roughly 192 days as recently as 2024.
That buffer is disappearing. Israeli researchers built a pipeline that feeds CVE advisories and open-source patches into Claude. The system generates working proof-of-concept exploits for real vulnerabilities. Some come together in as little as 15 minutes. The whole pipeline took a few weeks to build.
The telemetry backs this up from several directions. Verizon’s 2026 DBIR tracked critical CVEs added to the CISA KEV catalog. Attackers weaponized 28.3% of them within 24 hours of disclosure. CrowdStrike’s 2026 Global Threat Report measured average eCrime breakout time — the gap between initial access and lateral movement. It hit 29 minutes, down from 48 the year before. The fastest recorded breakout: 27 seconds. In one case, attackers began exfiltrating data four minutes after compromise.
A monthly scan cycle can’t defend against a threat that moves this fast.
Where Scanners Still Guess
Compressed timelines make a familiar problem worse. Vulnerability scanners still hand teams a CVSS score. Teams treat it as settled fact. But severity and exploitability answer different questions. Research on the Exploit Prediction Scoring System makes this concrete. FIRST built the model specifically to close that gap. Their data shows something striking: organizations that patch everything scored 7.0 or higher end up chasing ghosts. Attackers exploit only 2.3% of those flaws in the wild.
EPSS is itself a machine-learning model. It trains on more than 1,100 variables and reaches a 0.838 ROC AUC score predicting real exploitation. Even the best prediction model on the market can’t resolve most “critical” findings into real risk or noise. It narrows the guesswork. It doesn’t remove it.
Pattern-matching scanners carry a specific blind spot worth naming. They catch known signatures well. They miss business logic. Authentication bypasses, like the one Google’s team caught, fall into that gap. So do flaws that only surface when several low-severity findings chain together. Signature-based tools tend to miss both. Skilled attackers — human or AI — go looking for them first.
The Bill for Guessing Wrong
Chasing a finding that turns out to be unexploitable isn’t free. High-fidelity false positives trigger full incident response. Each one burns $10,000 to $50,000 in wasted staff time. Mid-sized security teams lose $500,000 to $1 million a year to this cycle. Every hour a team spends there is an hour it doesn’t spend on the flaw an AI-equipped attacker might already be probing.
IBM’s 2025 Cost of a Data Breach Report is still the most current edition as of mid-2026. It puts the global average breach cost at $4.44 million. The same report found something worth noting: organizations using AI and automation extensively saved $1.9 million per breach on average. They also cut 68 days off the breach lifecycle. That’s the honest case for defensive AI — faster detection, faster triage, real savings.
It comes with a catch worth flagging, not glossing over. Security researchers, including Veracode, have documented AI-generated remediation code that looks clean but quietly opens a new flaw. Sometimes a patch for one vulnerability creates a different one. Speed on the defensive side only helps if someone confirms the fix actually closed the hole. A shipped patch isn’t proof of anything by itself.
Moving From Probability to Proof
If an attacker can generate a working exploit in 15 minutes, a probability score isn’t the right currency anymore. Penetration testing that validates every finding closes that gap.It attempts the exploit safely in a controlled environment, confirms the attack path end-to-end—including any chaining across separate weaknesses—and provides developers with exact reproduction steps instead of a raw CVE list.
Call it the proof gap: the distance between a scanner telling you something might be wrong and a validated test proving it is. Continuous validation platforms hold false-positive rates under 2%. Scan-only tools typically run 40% to 70%. Teams working toward NIST SP 800-53, ISO 27001, or SOC 2 Type II attestations should care about that gap beyond pure risk reduction. Auditors increasingly want proof a control works, not a scan log showing someone checked a box.
What This Changes for 2026
AI hasn’t invented new categories of attack. It removed something else: the delay defenders used to lean on. Months used to pass between disclosure and a working exploit. That gap gave patch cycles room to breathe. A finding that sat comfortably in the “probably fine” pile in 2024 now carries a much shorter fuse.
The fix isn’t a faster scanner. It’s proof, checked continuously instead of quarterly. Want to see what that proof looks like in practice? See a validated pentest report and judge the gap for yourself.
Related: AI Companies Just Built Their Own Internet: How MCP Could Change Everything
