A zero-day vulnerability hands attackers a head start measured in hours, not weeks. Security teams have always raced to close that gap. AI is now changing how that race begins — and the change is cutting both ways. The same technology helping defenders find flaws faster may also be helping attackers build them faster.
How AI is changing the hunt for hidden flaws
Artificial intelligence is giving security researchers new ways to examine code, trace unusual behaviour and identify flaws that conventional tools may overlook. Instead of relying only on known attack patterns, AI-assisted analysis can surface suspicious logic earlier and point investigators toward the weakness sooner.
The effect is most visible around zero-day vulnerabilities — flaws the vendor does not yet know about and has not patched. In this space, every hour between discovery and action changes the level of risk.
The zero-day window is where the pressure shows first
Zero-days carry unusual weight in security response. There is no vendor patch to download and no advisory to follow. The timeline depends entirely on how quickly researchers understand the flaw and how quickly affected organisations can act on that understanding.
AI compresses the first part of that timeline. The second part depends on operational readiness, not processing power.
What the Minimus analysis says about post-discovery response
A recent Minimus analysis considers how container composition, dependency records and rebuild speed affect the response after an unknown flaw is exposed. The conclusion is pointed: faster analysis helps only when organisations can also establish where the vulnerable software is running.
A researcher may identify a flaw in minutes. If the organisation does not know which systems run the affected component, those minutes do not translate into protection.
Google's May 2026 report: AI on the offensive
In May 2026, Google Threat Intelligence Group reported the first case in which it believed a threat actor had used AI to help develop a zero-day exploit. According to the report, the exploit appeared in a Python script and bypassed two-factor authentication on a widely used service.
The framing is careful — "believed" rather than "confirmed." This is Google's assessment of the evidence, not a proven attribution. But even as a warning, it is significant: it suggests attackers are adopting the same speed advantage that defenders are chasing.
What remains unclear about the reported exploit
Public detail on the incident is thin. The specific service targeted, the number
