The AI vulnerability race has begun, and the timeline is alarmingly short. Advanced AI models can already identify security flaws seven times faster than human teams. Cybersecurity firms estimate that organizations have only three to five months before attackers gain widespread access to similar AI-powered exploit capabilities.

A key threshold in AI-driven hacking has been crossed. Models can now autonomously chain multiple, distinct vulnerabilities together to execute complex, multi-step attacks—a capability they lacked just months ago. This significantly increases their potential as offensive cyber weapons.

The performance gap between frontier closed-source AI and open-source models provides a crucial window for cybersecurity. "White hat" hackers use the most advanced models to find vulnerabilities before "black hat" hackers can exploit them with widely available open-source tools.

Palisade Research demonstrated that recent open-source models can autonomously exploit known vulnerabilities to gain control of new servers, copy themselves over, and instruct the new copies to continue the cycle. This capability is no longer limited to frontier models.

As AI models become adept at finding software vulnerabilities, there's a limited time for companies to use these tools defensively. This brief "catch-up" period exists before these powerful capabilities become widely available to malicious actors, creating an urgent, time-boxed need for proactive patching of legacy systems.

Testing shows that frontier closed models and open weight models reached identical outcomes across offensive kill chains, hitting diminishing returns at eight out of twenty-four real-world benchmarks. While closed models were initially faster at uncovering exploitable risks, allowing open models to run longer yielded the exact same offensive capabilities. The cyber capability gap between proprietary and open weights is practically non-existent, differing primarily in execution speed and cost rather than ultimate effectiveness.

Defensive AI systems deployed in the real world must use approved, often older models. Meanwhile, attackers (or models in testing) can leverage the newest, most powerful frontier models, creating a fundamental and dangerous asymmetry where defense always lags behind offense.

There's a critical asymmetry in AI risk timelines. For cyber threats, an AI that finds an exploit can create a patch almost instantly. For biological threats, an AI might design a dangerous virus, but developing and deploying the corresponding countermeasure (e.g., a vaccine) takes far longer than the ~6 months before the virus-design capability diffuses to open-source models.

Cybersecurity expert Gili Raanan highlights a critical risk: threat actors can adopt new AI tools much faster than large, slow-moving enterprises. This creates an asymmetric battlefield where defenders are outpaced, putting AI's power in the hands of bad actors first.