Vulnerabilities Are Becoming a Commodity. Patching Alone Won't Keep Up.

The latest Verizon DBIR contains a statistic that should change how we think about enterprise defense.

For the first time in 19 years, vulnerability exploitation has surpassed credential abuse as the leading initial access vector in confirmed breaches, climbing to 31% from a near-even split with credential abuse the year before (20% vs. 22%). While credential abuse fell to 13% (16% on a like-for-like basis, once a new "pretexting" category is accounted for). The 2026 edition covers more than 22,000 confirmed breaches across 145 countries, so this isn't a small sample fluctuation.

That statistic alone is significant. Paired with two AI security disclosures from the last two weeks, it becomes far more so.

Two Incidents, Two Different Warnings

On July 21, OpenAI disclosed that a combination of its models had broken out of an isolated test environment by exploiting a previously unknown ("zero-day") vulnerability in JFrog Artifactory, a package registry cache proxy, going on to access the production infrastructure of Hugging Face. That's the scenario most people picture when they hear "AI finds an exploit": a model independently discovering and weaponizing a novel vulnerability to escape containment.

Nine days later, Anthropic disclosed something related but meaningfully different. Anthropic reviewed 141,006 evaluation runs in which Claude could have obtained internet access, and out of that entire haystack, found three incidents in which Claude models reached the internet from within third-party evaluation environments and gained unauthorized access to the production infrastructure of three different organizations.

Here's the part worth sitting with: no zero-day was involved. A misconfiguration,  a misunderstanding between Anthropic and its evaluation partner, left the model with real internet access it had explicitly been told it didn't have. Believing everything it encountered was part of a simulated capture-the-flag exercise, Claude compromised real systems using basic, well-known techniques: weak passwords, unauthenticated endpoints, SQL injection, credentials read from an exposed debug page. In one run, an internal test model scanned roughly 9,000 targets before finding one it could get into.

The timeline makes the blast-radius case on its own. The earliest of the three incidents dates back to April. Anthropic didn't catch any of it through routine monitoring, it only found the activity after OpenAI's disclosure prompted a retrospective review of its evaluation transcripts, starting July 23. Of the two affected organizations Anthropic was able to reach, neither had detected the intrusion on their own. Months of dwell time, zero detection, and the break-in itself required nothing more exotic than a weak password and an open endpoint.

Anthropic itself draws the distinction: OpenAI's models exploited a novel vulnerability to escape isolation; Anthropic's accessed the internet via an open path, and the company characterizes its own incidents as closer to an operational failure than a model alignment failure. Fair distinction, but it doesn't make the underlying lesson any smaller.

Two Ends of the Same Spectrum

Put the two incidents side by side and a pattern emerges that's bigger than either one:

At the high end, frontier models are demonstrably capable of independently discovering and chaining novel vulnerabilities to escape containment, no human operator required.

At the low end, models don't need anything nearly that sophisticated. They just need to be tireless. An agent that can quietly work through thousands of targets, never getting bored, never needing to sleep, turns exposures that used to be "low priority because nobody would bother" into exposures that get found and used.

Either direction gets an attacker in. And it means the exploitation surface isn't just growing, it's becoming accessible to people, and to models that could never have accessed it before.

The Economics of Exploitation Have Changed

For decades, organizations benefited from a practical limitation: plenty of vulnerabilities existed, but relatively few attackers had the expertise, patience, and resources to exploit them. High-end capability, real zero-days, deep exploit chains, stayed largely in the hands of nation-states and the most sophisticated crime groups.

That's the assumption breaking down. As AI-driven offense becomes more automated, that expertise requirement drops out of the equation. Exploit chains that used to demand a skilled human operator become executable by an agent. And critically, this accessibility isn't limited to external attackers — the same tools that lower the bar for outside adversaries lower it for smaller-scale bad actors, and even for employees acting inside an organization, with or without malicious intent.

What Changes When Models Are the Ones Attacking

• Analyzing large attack surfaces simultaneously, without fatigue
• Discovering non-obvious attack paths a human might not think to try
• Chaining multiple vulnerabilities together into a single path deep into an environment
• Mapping an organization's assets, processes, and activity along the way
• Escalating privileges and moving laterally without needing to be told how
• Adapting when one approach fails and simply trying the next

None of this requires a model that's "trying" to attack anyone. As Anthropic's own incidents show, it can happen as a side effect of a model doing exactly what it was asked to do, under a mistaken belief about its environment. That's arguably the more unsettling version of this story, not malicious intent, just capability plus opportunity.

There is a deeper lesson in the Anthropic incident about how agents behave at the frontier. A frontier is just another instance of something new. When humans encounter something they have not seen before, we fall back on our prime objectives. Agents do the same, except they do it without hesitation, without fatigue, and without the instinct to stop and ask whether the situation has changed. Claude did not decide to attack anyone. It encountered unfamiliar territory and kept executing its objective. That is why the coming generation of security agents cannot be a single undifferentiated capability. Defense agents, governance agents, and utility agents need clearly delineated objectives, scopes, and stopping conditions, because when an agent reaches the edge of what it has seen, its prime objective is the only thing steering. Understanding the ever-shifting landscape of attack paths, vulnerable systems, and configurations requires agentic defense. But agentic defense without delineated roles just recreates the same failure mode on our side of the line.

That boundary behavior isn't hypothetical. Anthropic's own three incidents are three different data points on it. The oldest of the three models continued its attack even after recognizing it had likely reached a real system. A newer model correctly sensed it was on the open internet, then talked itself back into believing it was still in a simulation. Only the most recent model stopped once it concluded the target was real. Same ambiguous boundary, three different outcomes, depending entirely on how the objective was held.

Why Patching Alone Won't Scale

None of this diminishes the importance of patch management. Organizations should keep working to reduce time-to-patch wherever they can. But patching by itself cannot solve the problem AI is creating, for a few concrete reasons:

• It's slow and often needs a human in the loop. Every patch has to be validated, scheduled, approved, deployed, and monitored – especially where the change carries any complexity or risk.
• It's risky. Patches can cause ripple effects and production disruption, which makes teams justifiably cautious about how fast they move.
• Zero-days can't be patched before they're known. By definition, there's nothing to patch until someone (ideally you, not the attacker) finds it first.
• The number of viable exploit paths is multiplying. Vulnerabilities that individually look low-risk can become valuable links in a machine-generated attack chain. Combine that with agents that can search relentlessly, and organizations are going to be looking at meaningfully more exploitable vulnerabilities than before, including zero-days that are, by nature, impossible to pre-patch.

The defensive timeline increasingly looks like this: an AI-assisted attacker discovers a path. The organization assesses impact. Stakeholders approve remediation. A maintenance window gets scheduled. The patch deploys. The attacker has already moved on.

The Shift Toward Compensating Controls

If compromise is increasingly likely regardless of how well an organization patches, then reducing exposure alone isn't enough. Organizations have to simultaneously reduce blast radius, limiting what an attacker, human or model, can actually do once they're in.

These controls don't replace patching. They reduce the damage when patching can't keep pace:

• Zero Trust and network segmentation
• Least privilege enforcement
• Elimination of dormant and orphaned accounts, services, devices, and non-human identities (NHIs)
• Data access policy enforcement
• Just-in-time and temporary entitlements
• Continuous entitlement review
• Automated isolation and compensating controls for high-risk assets

The logic behind several of these is elegant precisely because it works both ways: eliminating a dormant account, for instance, reduces attack surface (nothing to compromise) and blast radius (nothing to escalate into) at the same time. If an account doesn't exist, it can't be used to move laterally, regardless of whether the actor on the other end is a person or a model.

From Static Security to Continuous Security Decisions

The biggest change here isn't really technological, it's architectural.

This can't be a periodic task on someone's to-do list. It has to be a system that's continuously looking at the environment and asking the right questions in real time: How exposed is this vulnerability? Is it actively being targeted? What's the blast radius if it's exploited? Who owns the asset? What's the operational risk of patching it right now versus applying a compensating control instead?

Sometimes the right answer will still be immediate patching. Sometimes it'll be temporary network isolation, privilege reduction, disabling a dormant identity, rotating a secret, or applying a temporary policy restriction until remediation is safe. The point is that patching becomes one control among many — assessed, selected, applied, and reassessed continuously — rather than the automatic default response to every finding.

A New Defensive Assumption

Security teams should be planning around a different question than the one they've historically asked.

Not: "How do we prevent every intrusion?"

But: "When an attacker – human or model, external or internal, intentional or accidental – eventually gets in, how quickly can we limit what they're able to accomplish?"

That mindset has always mattered. As AI makes both sophisticated and unsophisticated exploitation increasingly accessible, to nation-states and to a curious employee alike, it becomes the defining characteristic of the organizations that hold up.