AI Cuts Exploit Window to 1 Day; 10K+ Zero-Days Found in 1 Month

For cybersecurity practitioners, the collapse of the vulnerability-to-exploit timeline from weeks to just one day marks a paradigm shift. It means that every newly disclosed CVE must be treated as a zero-day threat from the moment it appears. The J.P. Morgan report quantifies this with staggering numbers—over 10,000 high- and critical-severity zero-days discovered in a single month by offensive AI tools—forcing organizations to rethink patch orchestration, detection engineering, and their entire incident response posture.

A stark new warning from J.P. Morgan Asset & Wealth Management underscores the escalating cybersecurity crisis driven by artificial intelligence: the average time between a vulnerability being disclosed and its first exploitation has collapsed to a single day, effectively turning every newly found flaw into a zero-day threat. The report, published in early August 2026, paints a picture of a global digital environment where the window for defense is vanishing so rapidly that traditional patch management cycles are rendered obsolete. The convergence of advanced AI models—including Mythos and GPT 5.5—with a chronic talent deficit and surging attack volumes has created what the report likens to a 'tornado alley' for corporate security teams.

“

Global cyberattacks increased 18% in 2025, with approximately 75,000 attacks occurring every hour.

In a single month of testing, these AI systems identified more than 10,000 new high- and critical-severity zero-day vulnerabilities, many of which had never been catalogued in public databases. This breathtaking scale of discovery is a double-edged sword. While the same models empower defenders to find and fix flaws faster, malicious actors—ransomware gangs, hacktivists, and even terrorist groups—are leveraging identical capabilities to identify and weaponize weaknesses with unprecedented speed. The result is a race where even minutes matter, yet organizations are often weeks behind. The report notes that in nearly 60% of breaches, a patch was already available at the time of compromise, illustrating a tragic disconnect between available remediation and actual implementation.

This patch gap is compounded by sheer volume. Global cyberattacks increased 18% in 2025, with approximately 75,000 attacks occurring every hour. Phishing remains the primary infection vector, feeding a pipeline that industrializes intrusion. Behind these statistics lies a staggering workforce shortage: nearly 4.8 million cybersecurity positions unfilled worldwide, according to the report. The combination of a hyper-fast threat landscape and a severe deficit in skilled defenders creates a perfect storm, particularly for small and mid-sized enterprises that cannot afford 24/7 security operations centers or dedicated vulnerability management teams.