AI just found a zero-day no human had reported — both sides now have it

In late 2024, an AI agent did something no AI had publicly done before: it found a real, exploitable, previously-unknown vulnerability in a piece of software running on billions of devices — and no human had ever reported it.

The software was SQLite, one of the most widely deployed and heavily tested codebases on the planet. The bug had survived years of human review, fuzzing and scrutiny. An AI agent purpose-built for vulnerability research found it anyway, by reasoning about the code the way a security researcher would — just faster, and without getting tired.

That milestone matters far beyond one bug in one database engine. It is a signal that the discovery of unknown vulnerabilities — the zero-days that no patch exists for — is no longer gated by the supply of skilled human researchers. And that changes the threat model for everyone.

The asymmetry has shifted

For decades, the scarcity of vulnerability-research talent acted as a natural brake on both sides. There were only so many people in the world who could read a complex codebase and find a subtle memory-corruption bug or logic flaw. That scarcity protected defenders as much as it limited attackers.

AI removes the brake. The same techniques — AI-guided fuzzing, automated code reasoning, machine-scale analysis of binaries and source — can now surface classes of bugs that previously sat undiscovered for years. Google’s OSS-Fuzz programme has already used AI to uncover real vulnerabilities in mature open-source projects. Research agents are being pointed at codebases specifically to find what humans missed.

The vulnerabilities were always there. What’s new is that finding them no longer requires a rare human; it requires compute.

This is genuinely dual-use. The same capability that lets a vendor harden their own product before shipping lets an adversary harvest unknown flaws in the software you depend on. The defenders who invest in it get safer; the attackers who invest in it get a steady supply of weapons nobody has a signature for yet.

Why “unknown” is the dangerous word

Your security programme is built almost entirely around known threats. Vulnerability scanners check for published CVEs. Antivirus and EDR match known signatures and behaviours. Patch management closes documented holes. All of it is reactive by design — it can only defend against what has already been catalogued.

An AI-discovered, not-yet-public vulnerability is invisible to all of it. There is no CVE to scan for, no patch to apply, no signature to match. The first time most organisations learn such a bug exists in their stack is when it is used against them.

You cannot patch your way out of this, because the thing isn’t on the list yet. What you can do is reduce how much an unknown vulnerability is worth to an attacker who finds one — and that comes down to architecture, not patching.

What actually protects you when the bug is unknown

When you can’t rely on knowing about a vulnerability in advance, defence shifts from “block the specific attack” to “limit what any compromise can reach.” The questions that matter:

• If one system falls, what does the attacker get? Flat networks and over-permissioned identities turn a single unknown bug into a full breach. Segmentation and least privilege turn it into a contained nuisance.
• Would you even see it? Detection and response are what catch the use of an exploit you couldn’t have predicted. Most organisations massively over-invest in prevention and under-invest in the ability to notice they’ve been hit.
• How much of your stack do you actually understand? Unknown vulnerabilities hide in the software you’ve forgotten you’re running — the unmaintained dependency, the legacy service, the third-party component three layers down.
• What is your real key-person and supply-chain risk? The blast radius of an unknown bug is decided long before the bug is found, by how the environment is built.

The honest position

It is tempting to treat AI-driven vulnerability discovery as a far-off, advanced-adversary problem. It isn’t. The capability is real now, it is improving quickly, and it is available to both sides. The organisations that come through this well won’t be the ones with the most tools — they’ll be the ones who genuinely understand their own environment and have built it so that a single unknown flaw can’t cascade.

That understanding doesn’t come from a scanner. It comes from a senior, independent assessment of how your systems are actually built, what an attacker could reach, and where one bug would become a breach.