The window between a security vulnerability being disclosed and attackers exploiting it has collapsed from roughly a year in 2021 to one day in 2026, according to Michael Cembalest's "Patchmageddon" report published in July 2026 with input from J.P. Morgan Asset Management's cybersecurity leadership. The report finds that AI models like Anthropic's Mythos and OpenAI's GPT-5.5 now uncover previously unknown vulnerabilities at a scale no human research team can match, while hackers use the same tools to exploit them just as quickly. Nearly 80% of exploitations now occur on or before their public disclosure, the report states.
Anthropic and its Project Glasswing partners discovered more than 10,000 new high- and critical-severity zero-day vulnerabilities in the first month alone, the report says. The exploitation timeline is projected to shrink further to one minute by 2027. Of 530 high- and critical-severity findings Anthropic reported to open-source maintainers by May 2026, only 75 had been patched. A Linux Foundation and Harvard study cited in the report found that 23% of the top 50 open-source projects had a single developer responsible for more than 80% of lines added, and 94% had fewer than ten developers writing more than 90% of the code. Anchore counted more than 18 million npm packages listing a single maintainer. Datadog's February 2026 numbers show the median dependency runs 278 days behind its latest major version. Research cited in the report found that over 80% of security professionals have skipped a patch to avoid disrupting business operations.
According to the report, J.P. Morgan's technology leadership is explicit in its guidance: run current versions and move off dependencies where you can't identify who maintains them, where the maintainer appears to be a one-person operation, or where the package looks abandoned. "If you can't name who maintains a package, you can't count on anyone to fix it," the report states. Cembalest warns that capabilities now confined to a handful of nation-state units are expected to be reproducible in freely available open-weight models within 12 to 24 months. Hamish Low at the Institute for AI Policy and Strategy gives a Chinese Mythos-class model a 40% chance by February 2027 and near-certainty by the end of that year.
The report explains that open-source software faces this pressure first because it forms the foundation of modern software and because the source code is visible to all. The people expected to absorb this flood of AI-driven vulnerabilities are mostly volunteers, the report notes, and many communities that write and support open-source have burned out. Cembalest argues that organizations will have to judge themselves on patching speed, not just accuracy, as programs built around 90-day disclosure windows are now measured against a clock that runs in hours. When exploits took months to appear, deferring patches to avoid disruption was defensible, the report states, but now that they show up within a day of disclosure, the unpatched system poses the bigger threat to keeping the business running.
The report recommends that enterprises stop building security strategy around free open-source software and instead pay for professional open-source backed by a vendor with accountability or a foundation with staffed security response and funded maintainers. Cembalest outlines a plan that includes controlling where open-source comes from by pointing internal artifact proxies at supported sources that ship fixes before CVEs go public, measuring how fast fixes reach production by tracking the time from disclosure to deployed fix for top dependencies, and using AI to find and propose fixes while keeping people on the merge. Erik Scales, who leads platform engineering for Tanzu Platform at Charles Schwab, said in a VMware Explore talk this year that everyone's now worried about being on the news and being fired. The core message is urgent: organizations running their own software, especially financial institutions, must adapt their security strategy to a reality where waiting is exactly what attackers are counting on. Enterprises accustomed to slow-moving patch cycles will need to redefine what acceptable risk looks like when the threat model itself has fundamentally shifted overnight.