The Other Side of Glasswing

On May 11, Google's Threat Intelligence Group disclosed that it had intercepted the first known AI-generated zero-day exploit in the wild. A criminal actor used a large language model to discover a two-factor authentication bypass in a widely deployed open-source administration tool, then wrote a Python exploit to weaponize it. GTIG caught it before mass deployment. The tells were almost embarrassing: educational docstrings, a hallucinated CVSS score, textbook Python formatting.¹ The attacker's LLM wrote code the way a tutor explains homework.

Two days earlier, Anthropic had shared Project Glasswing with 40 partner organizations as a defensive vulnerability-scanning platform. We covered that launch in "The Zero-Day Factory."⁷ The pitch was that AI could find vulnerabilities faster than humans, and that getting there first was the whole game. Google's disclosure confirmed the corollary: attackers had already arrived at the same conclusion independently, using the same underlying technology, on their own schedule.

John Hultquist, who leads GTIG's threat analysis, called the interception "a taste of what's to come."¹ State actors from China and North Korea had already shown, in GTIG's assessment, "significant interest in capitalizing on AI for vulnerability discovery."¹

The Speed Collapse

Mandiant's M-Trends 2026 report, published the same week, puts hard numbers on how fast the exploitation window has closed. The median time-to-exploit for newly disclosed vulnerabilities is now negative seven days.² Exploits are arriving before patches. The attackers are finding the bugs, writing the code, and deploying it while the vendor is still drafting the advisory.

The initial access handoff time has dropped to 22 seconds, down from over eight hours in 2022.² That is the interval between gaining a foothold on a system and pivoting to the next phase of the attack. Four years ago, defenders had a working day to detect and respond. Now they have less time than it takes to read this paragraph.

The raw volume is staggering. Mandiant tracked 90 zero-days exploited in the wild during 2025. The total CVE count hit 48,185 new vulnerabilities for the year, and 28.3% of those were exploited within 24 hours of disclosure.² The patch-then-exploit model that enterprise security has relied on for two decades assumed defenders would get there first. That assumption is dead.

"Time-to-exploit: negative seven days. Exploits arriving before the patch exists."
— Mandiant M-Trends 2026

Malware That Thinks

The Google zero-day was a one-shot: an LLM found a vulnerability, a human wrote the campaign around it. The next evolution is already deployed. In July 2025, Mandiant documented LAMEHUG, a Python infostealer attributed to APT28 (Russia's GRU military intelligence) that integrates LLM capabilities directly into its runtime.³

LAMEHUG queries Hugging Face language models in real time to decide its next actions on a compromised system. The malware does not carry a fixed playbook. It evaluates the environment it finds itself in and generates commands dynamically based on what the LLM recommends. Each execution produces different behavior on different hosts.

This breaks the fundamental assumption of signature-based detection. Traditional antivirus and endpoint protection work by matching known patterns. LAMEHUG's command sequences are generated fresh each time by an external model, so there is no stable signature to match. The malware's behavior is, in a meaningful sense, creative. It adapts.³

LAMEHUG is the first documented case, which means it is almost certainly not the only one. APT28 is sophisticated but not unique. The technique of offloading decision-making to a hosted LLM is straightforward enough that any group with API access can replicate it. The barrier is not capability. It is imagination.

The Platform Response

OpenAI launched Daybreak on May 11, the same day as Google's zero-day disclosure.⁴ The timing of both announcements on the same day was coincidental. The strategy was not.

Daybreak is OpenAI's cybersecurity platform, and it arrives in three tiers. GPT-5.5 standard handles general security analysis. GPT-5.5 Trusted Access for Cyber gets deeper system access for vetted organizations. GPT-5.5-Cyber, the top tier, is explicitly designed for red teaming and offensive security research.⁴ OpenAI launched with partnerships across Cloudflare, Cisco, CrowdStrike, Palo Alto Networks, and Oracle, among others.

Those are the companies that sell firewalls, endpoint protection, network security, and cloud infrastructure to most of the Fortune 500. OpenAI is positioning itself as the AI layer underneath the entire defensive security stack, in direct competition with Anthropic's Glasswing.

The arms race now has two major AI labs building vulnerability-discovery tools on the defense side. On the offense side, there is no partner list and no press release. There are just results. Researchers running AI agent swarms found over 100 kernel vulnerabilities across AMD, Intel, and Nvidia hardware for a total cost of $600.⁵ The offensive security tooling ecosystem has produced 70 new AI-powered tools in eighteen months.⁵ A single campaign using AI-assisted techniques breached over 600 FortiGate firewalls across 55 countries.⁵

The Supply Chain

Vulnerability exploitation is one vector. The software supply chain is another, and AI has accelerated it just as dramatically.

Sonatype's 2025 report counted 454,600 malicious packages published to public registries during the year.⁶ That number reflects a combination of AI-generated package spam, dependency confusion attacks, and typosquatting campaigns that can now be produced at scale with minimal human effort. Writing a convincing malicious npm package used to require understanding the ecosystem well enough to craft a plausible name, a functional README, and working code that also exfiltrates data. LLMs handle all of that in a single prompt.

The most dramatic example was Shai-Hulud, an npm worm discovered in September 2025 that compromised over 500 packages before detection. CISA issued an alert. Palo Alto's Unit 42 published a full teardown.⁶ The worm propagated through maintainer account takeovers and injected itself into legitimate packages, so downstream consumers installed it unknowingly through their normal dependency updates.

Supply chain attacks scale differently than vulnerability exploitation. A zero-day targets one product. A supply chain compromise targets every project that depends on the poisoned package, which in the npm ecosystem can mean tens of thousands of applications from a single point of compromise.

The Asymmetry

We have now published four pieces in what has become an unplanned security series. "The Zero-Day Factory" covered Glasswing's defensive promise.⁷ "The IDE Is the Attack Surface" documented 30-plus CVEs in the coding tools developers use to write the code that gets deployed.⁸ "The Injection Report" traced prompt injection cascades through agentic systems.⁹ This piece covers the offensive mirror.

The pattern across all four stories is the same asymmetry. Defense requires coordination: Anthropic shares Glasswing with 40 partners, OpenAI builds Daybreak with a dozen more, enterprises patch and scan and monitor and respond. Offense requires one person with API access and a weekend. The Google zero-day was built by a single criminal actor. LAMEHUG was built by one APT unit. The $600 kernel vulnerability sweep was a research project that could fit on a credit card statement.

Glasswing and Daybreak are real tools that will find real vulnerabilities and save real organizations from real breaches. Their existence is net positive. But the defensive side operates on institutional timelines. Partners must be vetted. Access must be tiered. Findings must be disclosed responsibly. Patches must be written, tested, and deployed. Each step adds days or weeks.

The offensive side operates on compute time. An LLM finds a vulnerability in minutes. A Python exploit gets written in the same session. The Mandiant data says the resulting attack arrives seven days before the patch. The defense is better-funded, better-organized, and slower. The offense is cheap, fragmented, and fast.

Hultquist was right. The Google interception was a taste. The LLM that wrote educational docstrings and hallucinated a CVSS score was a first attempt by a criminal who left fingerprints everywhere. The next one will not leave docstrings. The one after that will use LAMEHUG-style dynamic generation so there is nothing static to detect at all. The tools are the same on both sides. The constraints are not.