--- id: "nr-ai-finds-vulnerabilities-faster-than-anyone-can-patch-them-cac186" slug: "ai-finds-vulnerabilities-faster-than-anyone-can-patch-them-cac186" type: "raw_signal" title: "AI finds vulnerabilities faster than anyone can patch them" description: "Cipher found four EPICS Base flaws in under four hours, Check Point cut vulnerability research from hours to minutes with Daybreak, and Cognition, Oracle and Microsoft all launched agent-driven scanning and fixing." observed_at: "2026-10-28" record_date: "2026-10-28" date_kind: "observed_at" novelty: "notable" source_platform: "newruntime.com" topics: ["engineering-management"] entities: ["Causal Security","Cipher","EPICS Base","EPICS","CISA","OpenAI","Check Point","Daybreak","Check Point Research","Jonathan Zanger"] related_patterns: ["ai-native-orgs-move-to-review-and-orchestration","verification-bandwidth-is-the-scarce-resource","agent-security-moves-to-runtime-boundaries"] source_url: "https://www.theregister.com/security/2026/10/27/ai-hacker-finds-4-severe-bugs-in-popular-industrial-control-software-in-under-4-hours/5305811" source_urls: ["https://www.theregister.com/security/2026/10/27/ai-hacker-finds-4-severe-bugs-in-popular-industrial-control-software-in-under-4-hours/5305811","https://openai.com/index/check-point-daybreak","https://cognition.com/blog/devin-security","https://www.oracle.com/news/announcement/ai-world-oracle-advances-enterprise-security-for-the-ai-era-2026-10-27","https://microsoft.ai/news/mai-cyber-1-1-flash/","https://cyberscoop.com/openai-ai-generated-bug-reports","https://www.ox.security/blog/php2shell-day-5-the-panic-hasnt-turned-into-patching"] why_it_matters: "Cipher found four EPICS Base flaws in under four hours, Check Point cut vulnerability research from hours to minutes with Daybreak, and Cognition, Oracle and Microsoft all launched agent-driven scanning and fixing. But open-source maintainers are so swamped by AI-generated reports that some no longer accept them, and 93.6% of exposed PHP hosts were still unpatched five days after fixes shipped. Finding bugs is no longer the hard part. Getting them triaged and patched is." verification_level: "source-linked" signal_type: "synthesis" synthesis_of: [{"slug":"autonomous-ai-agent-cipher-finds-four-epics-base-15c4dc","title":"Autonomous AI agent Cipher finds four EPICS Base vulnerabilities, including a CVSS 9.8 integer overflow","url":"https://newruntime.com/posts/autonomous-ai-agent-cipher-finds-four-epics-base-15c4dc/"},{"slug":"how-check-point-accelerates-vulnerability-research-with-daybreak-64c29a","title":"How Check Point accelerates vulnerability research with Daybreak","url":"https://newruntime.com/posts/how-check-point-accelerates-vulnerability-research-with-daybreak-64c29a/"},{"slug":"cognition-launched-devin-security-2-0-combining-frontier-d42d7f","title":"Cognition launched Devin Security 2.0 , combining frontier-model scans with autonomous patching in parallel VMs.","url":"https://newruntime.com/posts/cognition-launched-devin-security-2-0-combining-frontier-d42d7f/"},{"slug":"oracle-launches-ai-security-mesh-a-managed-vulnerability-1232c1","title":"Oracle launches AI Security Mesh, a managed vulnerability-finding service built on OpenAI's frontier cyber models","url":"https://newruntime.com/posts/oracle-launches-ai-security-mesh-a-managed-vulnerability-1232c1/"},{"slug":"mai-cyber-1-1-flash-sharper-findings-and-01681c","title":"MAI Cyber 1.1 Flash: Sharper findings and fewer tokens inside MDASH","url":"https://newruntime.com/posts/mai-cyber-1-1-flash-sharper-findings-and-01681c/"},{"slug":"openai-s-daybreak-lead-says-ai-generated-bug-83da82","title":"OpenAI's Daybreak lead says AI-generated bug reports are overwhelming open-source maintainers; Patch the Planet has 458 of 661 patches accepted","url":"https://newruntime.com/posts/openai-s-daybreak-lead-says-ai-generated-bug-83da82/"},{"slug":"ox-security-93-6-of-measurable-php-hosts-e44b08","title":"OX Security: 93.6% of measurable PHP hosts still unpatched five days later","url":"https://newruntime.com/posts/ox-security-93-6-of-measurable-php-hosts-e44b08/"}] schema_version: "newruntime-agent-readable-v0.2" stable_id: "signal:ai-finds-vulnerabilities-faster-than-anyone-can-patch-them-cac186" retrieval_nugget: "Cipher found four EPICS Base flaws in under four hours, Check Point cut vulnerability research from hours to minutes with Daybreak, and Cognition, Oracle and Microsoft all launched agent-driven scanning and fixing." status: "published" visuals: [] editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]} routes: {"html":"https://newruntime.com/signals/ai-finds-vulnerabilities-faster-than-anyone-can-patch-them-cac186/","markdown":"https://newruntime.com/signals/ai-finds-vulnerabilities-faster-than-anyone-can-patch-them-cac186.md","json":"https://newruntime.com/signals/ai-finds-vulnerabilities-faster-than-anyone-can-patch-them-cac186.json"} --- # AI finds vulnerabilities faster than anyone can patch them ## Retrieval answer Cipher found four EPICS Base flaws in under four hours, Check Point cut vulnerability research from hours to minutes with Daybreak, and Cognition, Oracle and Microsoft all launched agent-driven scanning and fixing. Cipher found four EPICS Base flaws in under four hours, Check Point cut vulnerability research from hours to minutes with Daybreak, and Cognition, Oracle and Microsoft all launched agent-driven scanning and fixing. But open-source maintainers are so swamped by AI-generated reports that some no longer accept them, and 93.6% of exposed PHP hosts were still unpatched five days after fixes shipped. Finding bugs is no longer the hard part. Getting them triaged and patched is. From the Field Notes: - [Autonomous AI agent Cipher finds four EPICS Base vulnerabilities, including a CVSS 9.8 integer overflow](https://newruntime.com/posts/autonomous-ai-agent-cipher-finds-four-epics-base-15c4dc/) (2026-10-28) - [How Check Point accelerates vulnerability research with Daybreak](https://newruntime.com/posts/how-check-point-accelerates-vulnerability-research-with-daybreak-64c29a/) (2026-10-28) - [Cognition launched Devin Security 2.0 , combining frontier-model scans with autonomous patching in parallel VMs.](https://newruntime.com/posts/cognition-launched-devin-security-2-0-combining-frontier-d42d7f/) (2026-10-26) - [Oracle launches AI Security Mesh, a managed vulnerability-finding service built on OpenAI's frontier cyber models](https://newruntime.com/posts/oracle-launches-ai-security-mesh-a-managed-vulnerability-1232c1/) (2026-10-28) - [MAI Cyber 1.1 Flash: Sharper findings and fewer tokens inside MDASH](https://newruntime.com/posts/mai-cyber-1-1-flash-sharper-findings-and-01681c/) (2026-10-28) - [OpenAI's Daybreak lead says AI-generated bug reports are overwhelming open-source maintainers; Patch the Planet has 458 of 661 patches accepted](https://newruntime.com/posts/openai-s-daybreak-lead-says-ai-generated-bug-83da82/) (2026-10-28) - [OX Security: 93.6% of measurable PHP hosts still unpatched five days later](https://newruntime.com/posts/ox-security-93-6-of-measurable-php-hosts-e44b08/) (2026-10-27) Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json ## Continue in the graph Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`. - topic hub: [Engineering Management](https://newruntime.com/topics/engineering-management.md): Explore the engineering-management topic hub. - collection: [Raw Signals](https://newruntime.com/signals.json): Open every source-linked raw signal. - collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph. - whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)