AI shrinks vulnerability exploitation window to one day, raises cyber risks: J.P. Morgan

Advances in artificial intelligence are dramatically reshaping the cybersecurity landscape by enabling faster discovery and exploitation of software vulnerabilities, while organisations continue to struggle to patch them in time, according to a report by J.P. Morgan Asset & Wealth Management.

The report, warned that the gap between vulnerability disclosure and exploitation has narrowed sharply, leaving companies with little time to respond to cyber threats.

"The average time between the disclosure of a vulnerability and its first exploitation has fallen to a single day (a zero-day event), leaving companies little more time to react than residents of tornado alley," the report said.


It noted that while AI models such as Mythos and GPT 5.5 are significantly improving the ability to detect previously unknown software vulnerabilities, the same capabilities could also be exploited by malicious actors, including ransomware operators, terrorists and hacktivists.

According to the report, organisations are already lagging in responding to emerging threats. "Even when patches exist, companies often don't respond in time: in ~60% of breaches, a patch was already available at the time of compromise," it said.

The report highlighted that cyberattacks increased 18 per cent globally in 2025, with around 75,000 attacks taking place every hour, while phishing remained the leading attack vector. It also pointed to a global shortage of nearly 4.8 million cybersecurity professionals, adding further pressure on organisations' ability to defend against attacks.

J.P. Morgan said AI models are now capable of detecting thousands of previously unknown vulnerabilities at scale, fundamentally altering cyber risk. It cited findings that more than 10,000 new high- and critical-severity zero-day vulnerabilities were identified within the first month of testing advanced AI systems, many of which were absent from public vulnerability databases.

The report warned that attackers are increasingly able to reverse-engineer software patches within minutes using AI and quickly develop working exploits. It projected that the median time to exploit a vulnerability, which has already fallen to one day in 2026, could decline further to one minute by 2027.

At the same time, it stressed that AI can also strengthen cyber defences. "The same tools that are used to detect and exploit vulnerabilities can also be used to propose code fixes and remediate them," the report said, citing new security-focused AI tools being developed by Anthropic and OpenAI.

The report noted that businesses would need to prioritise rapid software updates and patch deployment, warning that companies must increasingly measure themselves on the speed of remediation rather than accuracy alone as a "tsunami of patches" looms.