Anthropic's New Research Compresses the Exploit Window From Weeks to Hours

Enterprise security teams have operated for years on an implicit assumption: when a patch ships, defenders have days to weeks before attackers weaponize the underlying vulnerability. Anthropic’s new security research, published this week, puts specific numbers to how badly that assumption has broken down.

What Happened

Anthropic researchers tested six Claude variants against two real vulnerability sets: 18 security patches in the Firefox SpiderMonkey engine, and 21 Windows kernel vulnerabilities from January–February 2026 Patch Tuesdays.

The Firefox results: 14 of 18 vulnerabilities confirmed within 40 minutes; a working proof-of-concept crash achieved in 12 minutes. Eight complete, functional Firefox exploits were built within 12 hours. The Windows kernel results: 18 of 21 vulnerabilities identified in under six hours. Claude Mythos Preview—the only model to complete this task—built 8 complete privilege escalation chains, each developed for approximately $2,000.

Mythos Preview was the strongest performer across all tests. The earlier Opus 4.x series completed the Firefox analysis but did not complete the Windows kernel chains.

Why the Patch Window Is Now the Wrong Mental Model

Microsoft’s standard rollout window runs seven to eleven days—the time between patch release and deployment across most enterprise systems. The research establishes that the gap between “patch available” and “working exploit exists” is now measurable in hours for an adversary using current frontier AI. The seven-to-eleven day window doesn’t mean defenders have time to patch before attack; it means defenders need a fundamentally different deployment strategy.

The cost figure deserves attention: $2,000 per Windows privilege escalation chain puts sophisticated exploit development within reach of threat actors who previously couldn’t afford the engineering time. The asymmetry that previously favored defenders—attacks are hard, patches are easy—has inverted for this class of vulnerability.

This follows earlier research showing AI can turn patches into working exploits in 30 minutes, but the Anthropic study extends the scope: it’s not just one vulnerability type or one engine; it’s a systematic methodology applied across both web engine and OS-level kernel vulnerabilities. The breadth suggests this is a capability, not a demonstration.

Source: The Decoder

Content created with AI assistance and reviewed for accuracy.