Anthropic: AI Turns Patches into Exploits in Hours

Anthropic's Study on the Speed of AIs Exploiting Vulnerabilities

Anthropic's security research team recently published a study that systematically measures how quickly large language models can exploit known vulnerabilities in software such as Firefox and Windows. These findings challenge long-held assumptions about security patching strategies.

When a software vendor releases a patch to fix a security flaw, a race immediately begins. Attackers can analyze the patch, reverse-engineer the vulnerability from it, and target systems that have not yet applied the update. According to the Verizon Data Breach Investigations Report cited by Anthropic, these so-called N-Day vulnerabilities account for a significant portion of real-world damage. Historically, reverse-engineering patches was a slow and specialized task, giving defenders some time to respond.

However, Anthropic's study indicates that this margin for maneuver is now almost nonexistent. Researchers explain that an isolated operator can now turn a month’s worth of patches into functional exploits in a single afternoon, for a few thousand dollars and without specialized expertise.

Security Patches as Roadmaps for Attackers

A security patch implicitly indicates where the bug was located. Attackers compare the old code with the new to identify the flaw. Historically, this process took weeks. A 2020 analysis by Mandiant showed that 16 of the 25 vulnerabilities took a month or more to be exploited. Anthropic measured how much large language models accelerate this process.

In their study, six Claude models were tested, including Mythos Preview, which is not yet publicly available. For the first test, researchers selected 18 security patches for SpiderMonkey, Firefox's JavaScript engine. Firefox was deliberately chosen: according to Anthropic, the browser is an ideal scenario for defenders. It updates automatically, and Mozilla has recently increased the frequency of minor updates from monthly to weekly. If even these short patch gaps are sufficient, other software is in much worse shape.

Mythos Preview successfully exploited 14 of the 18 vulnerabilities, proving it had found and understood each bug. The first proof appeared after 12 minutes, with thirteen others following within 40 minutes. The 14th took much longer, about three hours. Opus 4.5 managed only 2, while Opus 4.8 reached 11.

In reliability tests with 50 attempts per vulnerability, Mythos Preview reproduced seven of the 18 bugs in every attempt. Opus 4.8 and Opus 4.6 only achieved this level of consistency for one vulnerability each.

Development of PoC for 18 CVE SpiderMonkey

More important than a crash is whether the model can actually exploit the vulnerability to execute foreign code on the target system. Mythos Preview clearly took the lead here, producing eight functional exploits in about twelve hours. Opus 4.8 managed two, while Opus 4.6 and Sonnet 4.6 each succeeded in one exploit. The first exploit was ready within an hour of the patch going live, 18 days before the release of the patched Firefox 148.

Windows Kernel Without Source Code: 8 Privilege Escalation Chains

The second test was much more challenging: 21 vulnerabilities in the Windows kernel from the January and February 2026 Patch Tuesdays, all allowing an attacker to escalate from a restricted user account to full administrator rights.

Unlike Firefox, the Windows source code is not open. The model had to work with compiled binaries, public debugging symbols, machine-generated decompilation from the Ghidra analysis tool, a diff of the modified functions, and Microsoft's public advisory.

Mythos Preview found 18 of the 21 vulnerabilities in less than six hours, at a total cost of about $2,200 in API credits. Opus 4.8 found 15, while Sonnet 4.6 and Opus 4.7 each found 13.

Development of PoC for 21 Windows Kernel Vulnerabilities

For a complete privilege escalation, moving from a restricted user account to the highest privilege level, SYSTEM, Mythos Preview was the only model to succeed. It built 8 functional attack chains at a total cost of about $15,700, or about $2,000 per exploit. Opus 4.8 developed individual attack components but could not combine them into a complete chain.

Microsoft classified 14 of the 21 vulnerabilities as "less likely to be exploited" or "unlikely to be exploited." Mythos Preview managed to exploit 13 of these 14 vulnerabilities and even achieved a complete privilege escalation for a vulnerability classified as "unlikely to be exploited." According to Anthropic, Microsoft's rating system is calibrated for human security researchers. Once models like Mythos become more widely available, this calibration will need to change.

Timing exacerbates the situation. Even with Microsoft's automatic update service, Windows Autopatch, it takes seven days for 90% of registered devices to receive a patch and eleven days for a forced reboot. The eight attack chains from Mythos Preview were ready before a single device had automatically applied the patch.

Publicly Available Models Can Also Build Exploits

Anthropic emphasizes that the Claude models already available to the public can also develop exploits when security filters are disabled, albeit less efficiently. Models from other companies and open-source models likely have similar capabilities, significantly expanding the pool of potential attackers.

The old rhythm of monthly patch releases and staggered deployments is now outdated, argues Anthropic. It relies on the assumption that exploiting a patch takes weeks of expert work. The common term "N-Day," which measures the time between the patch and the exploit in days, is now misleading. "N-Hour" better describes the new reality.

Researchers acknowledge that a real attack requires additional steps, such as searching for vulnerable targets, delivering malicious code, and bypassing detection systems. But while these steps remain, the previously most time-consuming phase, the development of exploits itself, now takes only a few hours. Systems that are difficult or slow to update are at the highest risk, including industrial control systems, medical devices, and networked equipment with fixed maintenance windows or vendor-locked software, writes Anthropic.

A more sustainable solution than faster patches is to reduce the sources of bugs themselves, for example, through memory-safe languages like Rust or hardware-level protections that eliminate entire classes of attacks at once.