In May 2026, Google’s Threat Intelligence Group (GTIG) documented a first for its casework: a criminal group staging a mass-exploitation campaign around a zero-day that GTIG assessed as AI-assisted. The vulnerability was a two-factor-authentication bypass in a widely used open-source web-administration tool, a semantic logic flaw rooted in a hardcoded trust assumption; finding it required reasoning about what the software trusted and why. Traditional scanners and fuzzers had little to work with: no signature to match, no crash or anomaly to trigger; only the application’s flawed logic.
That reasoning used to be scarce human work; a model can now perform it at machine scale.
GTIG assesses with high confidence that the actor used a model to find the flaw and weaponize it; GTIG’s own proactive discovery reached the same flaw first, and the campaign never launched.
The defensive side already had records, for instance in 2025; based on intel from Google Threat Intelligence, the Big Sleep agent discovered an SQLite zero-day and helped foil an imminent exploit in the wild.
The episode rests on one company’s forensic account: compelling, but scene-setting rather than conclusive.
Four weeks later, Anthropic announced its new frontier model, Claude Mythos 5, and its guardrailed sibling for public release, Fable 5. Three days after that, a US export directive forced both offline; eighteen days later, the directive was withdrawn.
So, what did the launch change? The arrival of AI-assisted exploitation, but the May campaign is an example that made that case.
The route to an answer runs through a capability evaluation lab, an exploit-timing curve, a government audit of the patch pipeline, and a glimpse of what happened inside those eighteen days.
The Capability Question Closed in a Government Lab
Anthropic launched Project Glasswing, and on 22 May 2026 reported that it and its approximately 50 partners had used a pre-release build, Claude Mythos Preview, to find more than ten thousand high- or critical-severity vulnerabilities in systemically important software. Anthropic separately used the model to surface thousands more across open-source codebases.
Those are a vendor’s reports about its own product. So, had expert-level AI offensive capability arrived?
In April, the UK AI Security Institute (AISI) published capability evaluations on expert-level tasks and cyber ranges. In its cross-model comparison, OpenAI’s GPT-5.5 completed 71.4% of the tasks compared with 68.6% for Mythos Preview; a generation earlier, GPT-5.4 had achieved 52.4%.
On AISI’s 32-step “The Last Ones” cyber range, Mythos Preview became the first model to complete the full scenario, and GPT-5.5 the second. AISI evaluations, 13 and 30 April, 2026.
These capabilities reflected broader advances in autonomy, reasoning, and coding rather than a breakthrough unique to a single vendor.
Expert-level offensive capability, at least for the evaluated tasks, is no longer hypothetical. It has been independently demonstrated in models from at least two frontier labs, even if today’s AI systems remain imperfect.
The Exploit Window Was Already Inverting
Timing is the other half of the story. Mandiant’s M-Trends 2026 telemetry estimates mean time-to-exploit for 2025 at an estimated minus seven days on average: exploitation begins a week before a fix exists. GTIG’s historical time-to-exploit reporting shows how the trend developed, averaging 63 days across 2018 and 2019.
The window didn’t invert this year. It crossed zero before Mythos existed.
Attribution is a different matter. Mandiant doesn’t credit AI as the direct cause for the inversion; it points to specialized threat actors driving distinct attack trends and fundamental human and systemic failures. Its figures are one vendor’s telemetry, but they don’t stand alone: VulnCheck counts 28.96% of 2025’s known-exploited vulnerabilities as exploited on or before the day their CVE was published, up from 23.6% the year before.
The defensible claim is that AI-scale discovery is an accelerant pressing on an inversion already underway, not its root cause.
What AI touches isn’t only the pace of discovery. Models are also working further along the exploitation chain.
GTIG’s casework includes a state-linked group feeding a model thousands of prompts to work through CVEs and validate proof-of-concept exploits.
In AISI’s April evaluations, GPT-5.5 closed a reverse-engineering exercise in 10 minutes and 22 seconds at a cost of $1.73, work the security firm Crystal Peak benchmarked at around twelve human-hours. That’s one model’s number, though the skill reads as frontier-wide on AISI’s account. Reverse engineering is the core labor between a found flaw and a working exploit.
Whatever AI adds along that chain lands in a window that was already negative, and the question moves to how fast the receiving end absorbs what gets found.
Remediation Was Always the Bottleneck
In May, a government auditor measured the receiving end. The Commerce Department’s Office of Inspector General (OIG) found NIST’s management of the NVD insufficient to clear the backlog or keep pace with submissions and concluded that without significant changes the database can’t fulfill its mission. The enrichment backlog grew from roughly 13,000 CVEs in June 2024 to more than 27,000 by the end of 2025. The audit doesn’t point at the AI models; the causes it names (a 2024 contract lapse, unrenewed CISA funding, and plain submission growth) all predate them.
Since 15 April, 2026, NIST has prioritized for immediate enrichment the flaws in CISA’s Known Exploited Vulnerabilities catalog, in federal systems, and in software designated critical; the older backlog moved to “Not Scheduled.” Submissions rose 263% between 2020 and 2025. NIST enriched about 42,000 CVEs in 2025 and still fell behind.
Remediation itself runs slow, and it’s getting slower: On vendor telemetry, Verizon’s DBIR puts the median time to remediate critical vulnerabilities at 43 days, up from 32, with 60 to 70% of known-exploited flaws still open a week after detection. Qualys puts complex application remediation at just over five months. Edgescan finds 45.4% of flaws remain unpatched a year on.
Discovery is getting cheap, fast, and frontier-wide. The exploit window was negative before that happened. And the human system for absorbing what gets found (enrichment, triage, and patching) was past capacity before either.
Practitioners have always known patching runs slow; the new fact is that a government audit found the queue in front of it failing. Remediation was always the bottleneck, and AI-scale discovery is what makes it decisive: when finding flaws stops being scarce, the pace of fixing them is what sets the outcome.
Eighteen Days in June: The Governance Precedent
Discovery, timing, and the patch queue were in motion before June. What changed was access to frontier models.
Anthropic shipped Fable 5 and Mythos 5 on 9 June. On 12 June, the Commerce Department’s Bureau of Industry and Security sent the company an “is informed” letter imposing export controls, under which a foreign national’s access inside the US counted as an export in itself.
It was the first publicly reported export-control action applied to a specific commercial AI model. Who may touch a frontier model became a question of jurisdiction, not just licensing terms.
Its net effect, Anthropic said, was that it had to abruptly disable both models for everyone to ensure compliance, and it objected, as it complied, that a “narrow potential jailbreak” shouldn’t pull a deployed commercial model offline.
The directive named no specific concern; press reporting pointed to a jailbreak technique surfaced by Amazon researchers.
A 2 June executive order had directed a voluntary testing framework for advanced models while disclaiming any mandatory licensing or pre-clearance regime. On 23 June, Legion LegalTech, a San Jose legal-software firm built on Anthropic’s models, sued in federal court in Washington, DC, arguing the directive unlawfully required Anthropic to disable its models.
Within the same two weeks, it stopped being a one-company story. On 26 June, the government approved Mythos 5’s return for a vetted set of U.S. critical-infrastructure organizations, named in an annex to a letter from the Commerce Secretary. The same day, OpenAI released GPT-5.6 as a government-gated limited preview at Washington’s request, sharing its partner list with the government in advance. It objected publicly that gated access shouldn’t become the default.
The lesson generalized: frontier model access is now a dependency with a regulator in the loop.
The gate held for thirteen days, then GPT-5.6 reached general availability on 9 July.
On 30 June, Commerce lifted the controls, and Fable 5 returned to global availability on 1 July carrying new safeguards and commitments. a safety classifier trained against the reported technique, a public jailbreak-reporting program on HackerOne, and pre-release government testing for future frontier models. Mythos, the variant with fewer safeguards, remained limited to vetted organizations.
Eighteen days separated the directive from its withdrawal; Legion dropped its suit once access was restored, and as of late July 2026, that’s where it stands. The precedent arrived before the authority behind it was settled.
The Shift Lands on Remediation
Cheap discovery, a negative window, and a failing triage queue don’t hand the board to attackers; in the opening incident, the defense got there before the campaign started.
If discovery is cheap and frontier-wide, finding flaws is becoming less of a differentiator. If the window is negative and the NVD now enriches known-exploited flaws first, organizations must increasingly prioritize risk themselves. The measurable edge sits in remediation throughput.
The June episode gives auditors and security leaders a new entry in frameworks they already run: An eighteen-day loss of a frontier model is a supply-chain continuity event. NIST’s AI RMF 1.0 and its generative-AI profile supply the risk vocabulary, ISO/IEC 42001 makes the AI management system certifiable, and the EU AI Act’s Article 50 establishes transparency obligations for AI systems. Model access now belongs in the 42001 scope and on the RMF risk register.
Demonstrable AI governance and negotiated frontier access are landing on the same calendar.
The capability question closed first: expert-level offense moved from speculation to record in a government lab. Then the Governance broke pattern, and it broke on the capability class, not one company. The directive landed three days after a launch with April’s scores already on the record, and within the month the rival lab was gated at the government’s own request. The median critical patch still takes forty-three days.
The rules now move faster than the fixes. What they can’t move is the speed at which humans absorb what gets found.
