Zero Day Clock: when the time to patch a vulnerability drops to zero
A few years ago, when a security vulnerability was discovered, we had weeks or even months to fix it. Today, that window (the "time-to-exploit", tracked by the Zero Day Clock website) is heading towards zero.
The consequences are already visible: 500,000 victims in 2025, a 20% increase in one year.
AI, both shield and catalyst
While AI serves as our shield, it is also a catalyst for attackers: attack automation, phishing message writing, and vulnerability research.
The Mythos paradox
Mozilla's recent experience with Claude Mythos (Anthropic's model) perfectly illustrates this paradox: the model allowed them to find more vulnerabilities in one month than their teams used to find in a year.
So yes, that's great, because it makes our software more and more secure, but the fixes for these vulnerabilities (especially when they are public, as in open source) are valuable information for attackers. They can use them to attack users who have not yet updated their application, or similar software that has not yet applied those patches.
What now?
This situation is worrying and will challenge our defenses and best practices over the coming years. In the meantime, let's not forget to update our applications!
Sources
- Ministère de l'intérieur - Panorama 2025 des cyberattaques en France
- I-Lead - Cyberattaques en France en 2026 : la liste complète à jour
- Brinqa - The Zero-Day Clock Has Moved to Zero: What the Mythos Moment Means for Defenders
- Underscore_ – Il a eu accès à Mythos, l'IA trop dangereuse pour le public / Sylvestre Ledru (Mozilla)
- Cefii - Cybersécurité en 2026 : chiffres clés et menaces
- Cybermalveillance.gouv.fr