N-day is Becoming N-Hour. Patching Faster Won't Save You. N天漏洞正变为N小时漏洞。修补得更快也无济于事。

TL;DR

• AI models like Anthropic's Claude Mythos can reverse-engineer public security patches into working exploits in under an hour, collapsing the traditional defense window from weeks to hours.
• The concept of "N-day" vulnerability has shifted to "N-hour," creating a "Vulnpocalypse" where patch disclosures inadvertently arm attackers with precise roadmaps to existing flaws.
• Traditional patching strategies are failing due to operational constraints and volume, with median fix times increasing while average exploit timelines drop below 24 hours.
• Security validation must shift from assuming vulnerability to proving exploitability through control testing and safe live exploitation, focusing on the 85-90% of assets that cannot be directly tested.

Why It Matters

This development fundamentally breaks the historical assumption that defenders have sufficient time to patch vulnerabilities before they are actively exploited in the wild. For AI practitioners and security professionals, it signals that reactive patching is no longer a viable primary defense strategy, necessitating a pivot toward proactive validation and control-based resilience.

Technical Details

• AI-Driven Exploit Generation: Anthropic’s red team demonstrated that Claude Mythos Preview could convert 18 Firefox patches into 8 working code-execution exploits autonomously, with the first exploit deployed within an hour of the patch release.
• Binary Analysis Capabilities: In more complex scenarios involving Windows kernel bugs, the model analyzed stripped binaries and decompiler output (without source code) to create proof-of-concept crashes for 18 out of 21 CVEs, chaining 8 to SYSTEM level access.
• Cost and Accessibility: The exploit generation process incurred costs of approximately $2,000 per chain, and similar capabilities were observed in public Claude models with safeguards enabled, indicating this is not an isolated or restricted feature.
• Benchmark Discrepancy: The AI successfully exploited bugs previously rated by Microsoft as "Exploitation Unlikely," highlighting that human-calibrated risk assessments are becoming obsolete against automated AI analysis.

Industry Insight

Organizations must abandon the reliance on rapid patching as the sole mitigation strategy, given that operational realities (regression testing, downtime) prevent them from keeping pace with AI-accelerated exploit development. Instead, security programs should implement continuous exposure validation that tests defensive controls against specific attack chains, ensuring that even if an exploit exists, the organization's defenses can block its execution.

TL;DR

• Anthropic的Claude Mythos模型能在发布补丁后一小时内将代码差异转化为可工作的利用程序，彻底颠覆了传统的N-day防御时间窗口。
• 传统依靠“快速修补”的策略已失效，因为AI逆向工程速度远超人工部署补丁的速度，导致“漏洞末日”（Vulnpocalypse）成为现实。
• 数据显示2026年平均利用时间缩短至24小时以内，而企业中位修补时间长达43天，巨大的时间差使得仅依赖补丁管理无法保障安全。
• 安全重心应从假设漏洞存在转向验证控制措施的有效性，通过模拟攻击行为链来证明防御体系能否阻断实际利用路径。

为什么值得看

这篇文章揭示了AI自动化漏洞利用对网络安全防御范式的根本性冲击，指出传统的基于补丁管理的防御体系在AI时代已不再可靠。对于AI从业者和安全专家而言，理解这一从“N-day”到“N-hour”的转变，是制定未来安全战略和应对新型威胁的关键前提。

技术解析

• AI逆向工程能力：Anthropic的红队测试显示，Claude Mythos Preview仅凭公开代码差异和两个构建版本，就能在不到一小时内将Firefox补丁转化为8个代码执行利用程序；在Windows内核漏洞测试中，它在31分钟内生成概念验证崩溃，并将8个漏洞链接至SYSTEM权限。
• 无源码利用突破：即使在缺乏源代码、仅有剥离二进制文件和反编译器输出的情况下，模型仍能高效工作，证明了其在复杂二进制分析上的强大能力，且公共模型（开启安全护栏后）也能生成部分利用程序。
• 时间窗口对比：历史上逆向工程需数周甚至数月，如今缩短至小时级；与此同时，企业修补已知利用漏洞的中位时间为43天，最佳表现者首周修补率也仅为30%-40%，形成极端的攻防不对称。
• 验证方法论：提出通过分解CVE为攻击技术链（TTP），针对实际环境中的EDR策略、分段、白名单等控制措施进行验证，而非仅仅依赖静态配置检查或无法在关键资产上运行的实时漏洞扫描。

行业启示

• 防御策略转型：企业必须放弃“修补越快越好”的线性思维，转而采用以风险为导向的暴露面验证策略，重点关注那些攻击者实际可利用且现有控制措施能拦截的场景。
• 重视控制层有效性：鉴于无法修补所有漏洞，安全团队应将资源投入到验证现有安全控制（如网络分段、端点检测）能否有效阻断攻击链的特定环节，从而降低实际入侵成功率。
• 重新评估漏洞优先级：传统的CVSS评分或通用漏洞严重性评级已不足以反映真实风险，需结合AI利用速度和具体环境中的控制有效性，动态调整漏洞响应的优先级和资源分配。