AI accelerates open-source exploit clock from months to minutes by 2027

The Exploit Clock Has Shrunk Dramatically In the modern software landscape of 2026, the window between discovering a vulnerability and having it exploited has collapsed from roughly a year in 2021 to just one day today, with projections suggesting it will be mere minutes by 2027. According to Michael Cembalest’s report on "Patchmageddon," which draws input from J.P. Morgan Asset Management's cybersecurity leadership, the median time from disclosure to first exploitation is now down to one day and projected to reach one minute by 2027.

This acceleration is driven largely by advanced artificial intelligence models capable of analyzing code diffs at a scale no human research team can match. For instance, Anthropic’s Mythos model and its Project Glasswing partners identified more than 10,000 new high- and critical-severity zero-days in the first month alone. Consequently, almost 80% of exploitations now occur on or before public disclosure, rendering traditional vulnerability management cycles obsolete.

Open Source Becomes the Primary Target

The pressure from this AI-driven threat landscape falls disproportionately on open-source software because it forms the foundation of modern applications and its source code is publicly visible. While transparency is beneficial for collaboration, hackers view these accessible repositories as low-hanging fruit. The burden of absorbing this flood of vulnerabilities often lands on volunteer maintainers who are frequently overwhelmed or burnt out.

Data highlights the severity of the situation: Of 530 high- and critical-severity findings reported to open-source maintainers by Anthropic through May 2026, only 75 had been patched. This summer saw many bug bounty programs closed down as developers sought relief from the relentless pace of discovery and exploitation.

Strategic Shifts Required for Survival

Corporate security mindsets are forced to evolve rapidly due to this urgency. Experts highlight three critical areas where organizations currently face significant risks:

• Rising Model Capabilities: Open-weight models capable of matching capabilities found in nation-state units are expected to be available freely within 12 to 24 months. Analyst Hamish Low notes a 40% chance by February 2027 and near-certainty by the end of that year regarding Chinese Mythos-class models.
• Legacy Vulnerabilities: Most enterprise code runs dependencies pulled from public registries months or years ago. Datadog’s February 2026 data indicated a median dependency age of 278 days behind its latest major version, leaving systems exposed to one-day exploits.
• Changed Performance Metrics: Organizations will soon be judged on patching speed rather than just accuracy. Programs previously measured against 90-day disclosure windows are now competing against clocks that run in hours or minutes.

The "Free Beer" Myth Must End

The traditional security strategy of relying on open-source software as a cost-saving measure is no longer viable given the current threat velocity. A study by the Linux Foundation and Harvard revealed extreme concentration among top 50 open-source projects, where 23% had a single developer responsible for more than 80% of lines added. At registry levels, Anchore counted over 18 million npm packages listing a single maintainer.

As J.P. Morgan’s technology leadership advises, if you cannot identify who maintains a package or recognize it as a one-person shop, you cannot count on anyone to fix it. The era where enterprises enjoyed "decades of free beer" while being told they were irresponsible is over; the promise was never that open source would guarantee day-zero patches.

Making Security the Easiest Path

To mitigate these risks without disrupting business operations, experts suggest controlling the supply chain through internal artifact proxies like JFrog Artifactory or Sonatype Nexus. By pointing builds at a supported proxy such as Broadcom’s TrueSource, organizations can ensure developers receive patched versions of libraries that often ship before CVEs are publicly disclosed.

These proxies can also automate patching by blocking known-vulnerable versions and serving the nearest secure alternative, allowing builds to succeed without manual intervention or ticket filing. This approach allows companies to change their source repositories while maintaining existing developer habits and build pipelines.

Final Recommendations

To effectively address this evolving threat, organizations should implement a three-part strategy: measure the speed at which fixes reach production for top dependencies; maintain an inventory of who maintains critical packages to flag single-maintainer risks; and leverage AI tools to find and propose fixes while keeping code owners engaged in the merge process. Ultimately, adapting security strategies is essential for any entity developing or running significant software infrastructure.