Anthropic Warns of LLMs’ Impact on (Already Shrinking) N-Day Exploit Gap

New research from Anthropic serves as a stark warning about how AI models will make it easier and faster for threat actors to develop exploits targeting known vulnerabilities.

Anthropic researchers have previously evaluated how large language models (LLMs, which are AI systems trained to understand and generate human language) have impacted zero-day vulnerabilities. However, N-days – flaws that vendors have issued a patch for, but that end users haven’t necessarily applied – are also a major challenge for defenders. 

Look, that scary gap between CVE public disclosure and the first confirmed in-the-wild exploitation isn’t a new problem by any means; it’s something that defenders have been grappling with for a very long time. Just a quick glance at the data presented via the Zero Day Clock live dashboard shows just how quickly this gap has been shrinking. Historically that’s been due to a number of factors outside of AI, including better attacker tooling paired with lagging patch windows for organizations. 

But as this research shows, modern AI tools are now further intensifying this existing issue by giving threat actors the potential ability to accelerate and automate the process of creating exploits that target those vulnerabilities.

“Exploit development is not the only step in a real N-day campaign (target discovery, delivering the exploit to the target, and detection evasion all take time and resources too), but historically it has been the step most bottlenecked by scarce reverse engineering expertise,” according to the researchers in a post on Monday. “With frontier models, this bottleneck has largely fallen away.”

Anthropic researchers claimed that Claude Mythos Preview – its experimental, restricted-access AI model that the company unveiled in April – was able to build eight working code-execution exploits autonomously across 18 Mozilla Firefox security patches (the specific CVEs for these patches weren’t revealed). The patches were specifically in SpiderMonkey, Firefox’s JavaScript engine and a common entry for actual browser exploit chains. They were shipped in Firefox 148 (released February 24) and 149 (released March 24).

Running three independent trials for each model for each CVE (with a budget of three million tokens per trial), researchers found that Mythos Preview’s first proof-of-concept (PoC) came in around 12 minutes. They also tested how consistently each model could develop PoCs for the vulnerabilities. Researchers found that across 50 trials for each of the 18 Firefox vulnerabilities, Mythos Preview solved seven of them across all 50 trials. Other models lacked this level of consistency – Opus 4.8 and Opus 4.6 were only that consistent on one vulnerability, for instance. 

Additionally, researchers found the model was able to produce eight full exploit chains for 21 Windows kernel patches (specifically privilege elevation bugs from between January and February 2026) where the source code wasn’t available. Microsoft’s security advisories for these patches rated 14 of the 21 bugs as either "Exploitation Less Likely" or "Exploitation Unlikely."

These exploit chains escalated a low privilege user to full SYSTEM control.

“We ran the models three times on each vulnerability,” according to researchers. “We found that models are effective at accelerating N-days even without source code… Mythos Preview’s first PoC arrived in 31 minutes and all 18 arrived within six hours—for a total cost in API credits of roughly $2,200.”

Anthropic researchers said that their public models can build exploits too (if their "safeguards" are turned off), though not as many as Claude Mythos. On Tuesday, Anthropic announced the release of Claude Fable 5, a Mythos-class model that it said it has made “safe for general use.” Anthropic in its Tuesday announcement said that it has developed “safeguards” for this model that are aimed at making it harder for threat actors to abuse them; and it is also launching Claude Mythos 5, which has safeguards lifted in some areas (and which is deployed through Project Glasswing, a cybersecurity initiative for using AI to find and fix software vulnerabilities in critical infrastructure and widely used software before attackers can exploit them). 

The volume of N-day exploit findings, and the speed with which they can be produced, is going to dramatically change. Not only that, but it will no longer take an experienced and skilled individual to create these PoCs, said Anthropic. Someone would instead now need a few thousand dollars.

It’s not particularly surprising that today’s LLMs can produce N-day exploits, but Anthropic’s recommendation – “defenders should try to accelerate how quickly they deploy patches in response” – leaves much to be desired, and misses a large part of the equation. Organizations are oftentimes dealing with systems that are difficult to patch, including industrial control systems, or legacy systems underpinning many critical infrastructure entities.

“The typical patching playbook that software developers use today—with monthly release cadences, multi-week staged rollouts, and a lag between pre-release and stable channels—no longer holds,” according to Anthropic researchers. “It was built on the assumption that weaponizing a patch takes expert-weeks (and that there was a limited pool of experts capable of doing so). But ‘N-day’ has become dangerously misleading. N-hour is closer to the reality we now operate in."