The Vulnerability Trap: AI Patching Gaps

In September, OpenAI published a write-up of what it calls the Defense Factory, which it defines as "a continuous, agent-first operation for finding and fixing vulnerabilities." AI agents map systems, discover vulnerabilities, validate them in isolated environments, route each one to an owner, and ship verified patches. It grew out of an internal "code red" sprint that pulled in more than 250 people across over 100 service areas, and the results are strong. Weekly P0/P1 remediations jumped from a few dozen to more than 500. Fifty-three urgent or high-priority issues were closed on the first day. Agent routing was accepted 90.6% of the time, 37% of findings were caught as duplicates, and the false-positive rate after dynamic validation was 0.81%. Codex wrote every patch, and 0.53% were rolled back. Findings come in from Snyk, Semgrep and Tenable, and a shared SECURITY.md carries context between stages.

This is serious engineering, and I'd like more of the industry to build things like it. OpenAI is also candid about where it struggled. Environment setup "became a constraint on validation, so we started with selected services we could run repeatedly," and only 19.5% of findings were reproduced at runtime. Follow-up checks "exposed a gap between merged patches and fixes deployed across the fleet." Nor does OpenAI oversell the scope. The page is titled "Traditional cyber defenses alone are no longer sufficient," a whole section explains how the factory "augments traditional security," and the advice is to "start with one workflow and incrementally build towards a Defense Factory."

So my argument here is with the reader, not with OpenAI. By its own definition the factory is about vulnerabilities. The one box in the architecture labeled "Infrastructure security" sits in the panel that monitors the agents themselves. That's a reasonable scope for a vulnerability program, and it becomes a problem only when someone mistakes it for a security program. Vulnerability management, now accelerated by AI, is a must. Run it. But it covers roughly a third of how attackers actually get in. A CISO who builds the factory and stops there has a bigger problem than the one they just solved.

The factory answers a real threat

Start with what the factory gets right, because the threat it's built for is real.

I counted additions to CISA's Known Exploited Vulnerabilities catalog over the same window each year, 1 January to 13 October (raw feed). The totals were 152 in 2023, 139 in 2024, 197 in 2025 and 255 in 2026. That's up 29% on last year and about 75% on 2023–24. The more telling number is how many of those CVEs were disclosed in the current or previous year: 111 and 104 in 2023 and 2024, 206 this year. Nearly double. Attackers are weaponizing fresh vulnerabilities faster.

Other data says the same thing. Google's Threat Intelligence Group reports that monthly vulnerability disclosures doubled from about 5,000 in January to 10,740 in August, and that 141 vulnerabilities had already been exploited by August, more than the 127 for all of 2025. GTIG attributes much of this to attackers using LLMs to automate patch-diffing and n-day weaponization. CrowdStrike finds that 88% of exploitation using public proof-of-concept code now happens within 48 hours. The Verizon 2026 DBIR has exploitation overtaking credential abuse as the top breach vector for the first time, 31% against 13%.

OpenAI's framing matches this. Its threat model is agents running long operations on open-weight models, in fleets, exploiting weaknesses "long before a human-in-the-loop security response can find and patch the same vulnerabilities." If you're looking for the place where AI has measurably changed the game, this is it: the speed and volume of exploiting known vulnerabilities. The factory is built for exactly that, and the data backs it.

The ceiling is about a third

Now look at what those numbers leave out.

Exploits are the top initial infection vector in Mandiant's M-Trends 2026 for the sixth year running, at 32%. The DBIR puts them at 31%. Turn that around and roughly two-thirds of intrusions start somewhere else. In Unit 42's 2026 incident response data, identity-based techniques drove 65% of initial access: compromised credentials, MFA manipulation, help-desk impersonation. In Mandiant's data, voice phishing jumped to 11% and became the second most common vector, while email phishing dropped from 14% to 6%. North Korean operatives get hired as remote IT workers and walk in the front door. None of that involves a bug.

Even the exploit third is mostly code the victim didn't write. M-Trends names SAP NetWeaver, Oracle E-Business Suite and SharePoint as the top exploited vulnerabilities. In Google's analysis of 2025 ransomware cases, the most common way in was exploiting VPNs and firewalls, about a third of incidents. My 2026 KEV count is led by Microsoft, Cisco, Fortinet, Citrix, Ivanti, SonicWall and Check Point. You can scan and fix code you own. Vendor code you can only patch, mitigate, or wait on.

Then there's everything after the way in. Once inside, attackers increasingly skip malware and use the admin tools and scripting engines every enterprise runs by default. They live off the land. Mandiant puts the 2025 global median dwell time at 14 days, up from 11, driven by espionage and North Korean IT-worker cases that each sat at a median of 122 days. A code factory doesn't shorten dwell time. Detection and containment do.

Risk is a function of threat, vulnerability and impact, and the factory works on the vulnerability term. An organization that puts its whole AI security budget there can push its CVE count down hard and still get breached on a Tuesday, because the attacker logged in instead of breaking in. Attackers are economically rational. Harden the expensive link and they take the cheap one.

What AI hasn't changed, yet

The faster exploitation is real. The wider "AI is breaking everything" story isn't showing up in outcomes.

I went back through the five most-cited "frontier model caused a breach" stories of 2026. All five happened, and all five are narrower than their headlines. OpenAI's agents breaching Hugging Face comes closest to the scenario everyone fears: the agents found zero-days and got code execution on 41 production servers (OpenAI, technical report). But it was an evaluation run with safeguards switched off, no adversary sent them, and the way in ran through 14 Hugging Face credentials exposed in a public dataset. Anthropic's three cases came from a misconfigured evaluation environment at a third-party partner that left models with live internet access, and the models went after weak passwords and unauthenticated endpoints (Anthropic, The Register). The DeepSeek-driven campaign documented by Unit 42 failed on its autonomous track; the data theft through Citrix NetScaler came from the actor's parallel manual campaign. Unit 42's under-10-hour intrusion was a human operator driving AI agents, with no novel zero-days, and hard-coded credentials scraped from the victim's code repositories opened the path to secrets and the CI/CD pipeline (Unit 42). METR lost an API key through an exposed dashboard with a fail-open authentication bug, and attackers burned about $600,000 in credits (The Register, The Hacker News). The thread through all five is credentials and misconfiguration.

Ransomware tells a similar story. Volume is up: NCC Group logged 894 attacks in July 2026, the highest month of the year though still below the February 2025 record, and Black Kite counts 40% more attacks on manufacturers in the first seven months of 2026 than a year earlier. Yield is down. Chainalysis tracked roughly $820 million in on-chain payments in 2025, down 8%, while claimed victims rose about 50% and the share of victims paying fell to a record low of 28% (The Record, The Register). More attacks for less money looks like a saturated criminal market. RUSI calls AI's effect on ransomware incremental and points to business models as the historical driver of change, and Proofpoint finds AI improving phishing and credential harvesting but not the ransomware itself.

The incident responders agree. M-Trends says 2025 was not "the year where breaches were the direct result of AI," and that "the vast majority of successful intrusions still stem from fundamental human and systemic failures." In February, Google's Threat Intelligence Group found state-linked actors using AI across the attack lifecycle but said they had "not yet achieved breakthrough capabilities that fundamentally alter the threat landscape."

AI changed one thing measurably: how fast known vulnerabilities get weaponized. Everything else is moving at the old pace.

Even a perfect factory closes a third of the doors

Here's the strongest counter-argument. Every major vendor runs its own Defense Factory: Microsoft, Cisco, Fortinet, Citrix, SAP. Their code gets dramatically better and the edge-device problem shrinks. I think that's likely, and it would be good news. It still doesn't remove the need for the rest of the program.

The ceiling. Perfect code addresses the exploit third. Identity abuse, social engineering, insiders, misconfiguration and third-party access make up the rest, and none of them is a code defect.
Deployment. A merged fix protects nobody until it's running. OpenAI found this inside its own walls: follow-up checks exposed a gap between merged patches and fixes deployed across the fleet, and they kept automatic reopening switched off while they worked out how to account for deployment delays. Across the industry the gap is wider. The DBIR puts the median time to fully patch at 43 days and finds organizations fully patched only 26% of KEV flaws. Against a 48-hour exploitation window, that's an operational and organizational problem the factory doesn't solve.
What never gets the fix. End-of-life appliances, mainframes and the legacy estate every bank and manufacturer carries won't be rebuilt in anyone's factory. OpenAI's own experience points the same way. When environments were hard to reproduce, validation became the constraint and the team narrowed scope to services it could run repeatedly. A legacy estate is the hardest environment there is to reproduce.
After the way in. Dwell time, lateral movement and living-off-the-land activity happen after entry. Cleaner entry code doesn't help you detect someone already logged in with valid credentials.

Why the framing spreads

The tool shapes the problem you choose to solve. A coding agent is very good at reading code, reasoning about a diff and writing a patch. It's much less proven at reasoning about identity graphs, cloud IAM policy, or the call a SOC analyst makes when a login looks slightly off. Building the factory around what the model does well is a rational choice, and so is naming it something bigger than it is. "Defense Factory" sells better than "AI-driven vulnerability management," even though the second name is the accurate one. The frontier labs do the same when they disclose their models' offensive feats in language that reads like capability marketing. Remember that whenever a vendor benchmark becomes the headline of a security story.

The tool doesn't do the damage. The narrative does, the moment "we run continuous AI vulnerability management" becomes the answer to "are we secure?" in a board meeting or a regulatory review. A company whose environment is almost entirely code can lean on that answer longer than most. A bank with mainframes, branch networks, hundreds of vendors and a workforce that answers the phone can't.

What a sound program looks like

Build or buy the factory. Then fund and measure the other lanes with the same seriousness. Identity security, because credential and token abuse is how most attackers get in and move around. Cloud and configuration posture, because a misconfiguration needs no bug, only a checkbox nobody unchecked. Behavioral detection engineering, because living-off-the-land activity doesn't look like malware. Exposure and patch operations for the products you don't own, because the vendor's fix is worth nothing until it's deployed inside the exploitation window. Third-party risk, because your perimeter now includes everyone holding a key to your systems. And the human layer with the threat updated: a convincing call to the help desk now beats a phishing email, and both still beat a zero-day on cost per compromise.

The test I'd apply to any AI security product, including an excellent one, is simple. Which link in the attack chain does it break, and what covers every other link? For the Defense Factory, the honest answer is that it breaks the exploit link faster than anything we've had. That's about a third of the chain. Run it, then go fund the other two-thirds.