Open-source security in the AI exploit era: Patch without changing a thing

Within hours, someone points a model at the diff between the old and new versions and gets a working exploit back. Your scanner flags the CVE the next morning, a ticket gets filed, and the fix is scheduled into next week's change window. By then the exploit has been circulating for days.

That was a fine enterprise lifestyle choice last year, but it's considered out of fashion nowadays. And for good reason, as Michael Cembalest goes over in his "Patchmageddon" report from July 2026, which includes input from J.P. Models such as Anthropic's Mythos and OpenAI's GPT–5.5 now find previously unknown vulnerabilities at a scale no human research team can match.

Earlier coverage

• Binance hit by $6.3 billion theft, Brotli vulnerability impact noted Nov 1
• IBM Extends Scope and Reach of DevSecOps Workflows in the AI Era Nov 1
• Northflank security breach leads to abuse of customers' AI API keys Oct 31