Zero-day vulnerabilities are being found faster with AI, according to security company Echo, and defenders are looking for ways to keep up. On October 14, 2026, Echo, a company focused on securing the enterprise software supply chain, launched Echo Frontier. It says the offering is designed to protect organizations from flaws uncovered by large language models by turning newly found vulnerabilities into tested patches before they are publicly disclosed. Echo says Frontier is now generally available.
Why AI-found zero-day vulnerabilities worry security teams
Echo’s argument is that the usual order of events, where a flaw becomes public, gets a CVE and a fix, and then enterprises respond, no longer holds. According to the release, Anthropic research published on September 29 found that Zhipu AI’s open-weight GLM-5.3 produced working end-to-end exploits in 50 of 410 attempts on the ExploitBench benchmark, compared with 56 for Claude Mythos Preview. Echo notes that, unlike Mythos Preview, GLM-5.3 can be used by anyone, and says Anthropic called its release “a meaningful step change in the cyber capabilities available to attackers.”
Finding a flaw is only half the job. Echo cites research from 1Password’s Off-by-1 Labs that found 54% of 6,080 AI-generated patches either failed to fix the vulnerability, introduced a new one, or both.
How Echo Frontier handles zero-day vulnerabilities
Echo says Frontier builds on its existing infrastructure for vetting, patching, rebuilding and delivering open-source software. The process it describes has six steps:
- Discover: hunt for unknown vulnerabilities using model-driven analysis and human-led research.
- Validate: reproduce findings with a working proof of concept and identify affected versions.
- Notify: alert maintainers and coordinate disclosure as an authorized CVE Numbering Authority.
- Patch and test: develop and backport fixes, checking they stop the flaw without breaking the application.
- Deliver: privately deliver patched software through customers’ existing JFrog or Nexus infrastructure.
- Converge: move customers to the official upstream fix once it is available.
Fixes are validated against the exploit and compatibility-tested through the full application in a cloud environment, and customers receive an evidence trail to support compliance. As an example, Echo says it found a high-severity denial-of-service flaw in OpenEXR, then validated it, built and tested a patch and protected customers in about two days, around two months before an upstream fix was available.
The other side: questions about private delivery
Supporters of this approach would say that waiting for public disclosure leaves customers exposed while attackers may already be using the same AI tools. Faster, tested fixes could shrink that window. Echo’s CEO Eilon Elhadad said that if AI can find vulnerabilities before the traditional security ecosystem can, remediation has to move earlier too.
Others may see trade-offs. Delivering a fix privately to paying customers before the wider public knows about a flaw raises questions about who is protected first, and what happens to users of the same open-source project who are not customers. Echo says it notifies maintainers and coordinates disclosure, but the release does not explain timelines, how disputes with maintainers are handled or how long customers remain on a private build. The claims are also Echo’s own: the OpenEXR case is a single example, no customer is named, and no independent audit of the patches is cited. Any patch pipeline is itself a high-value target, so how Echo secures its builds and its delivery channel matters. The release does not address this, so we would treat it as an open question.
For more background on how quickly AI is changing security, see our stories on how Claude Mythos showed AI can outpace human cryptography research and Meta’s report of its AI model hacking another company in testing.
My view on zero-day vulnerabilities and AI
As a writer, I feel the core problem Echo describes is real: discovery is speeding up, and fixing is still slow. Pairing a patch with exploit validation and compatibility testing sounds like a sensible answer, especially given the 54% figure for flawed AI patches. But I would want to see independent testing, clear disclosure rules and transparency about how private fixes are shared with the wider open-source community. Security tools should earn trust through evidence, and readers are best placed to decide how much of this is proven so far.
FAQ: Echo Frontier and zero-day vulnerabilities
What is Echo Frontier?
It is an offering from Echo, launched October 14, 2026, that finds, validates and patches unknown vulnerabilities in open-source software and privately delivers fixes before public disclosure.
How does Echo deliver the patches?
According to Echo, patched software is delivered privately through customers’ existing JFrog or Nexus infrastructure, then customers move to the official upstream fix once it exists.
Is Echo Frontier available now?
Echo says Frontier is generally available.