Anthropic Research examined the ability of large language models to accelerate the development of N‑day exploits, which target vulnerabilities that have already been publicly disclosed but remain unpatched on some devices. The study focused on Mozilla’s Firefox JavaScript engine and Microsoft Windows kernel patches. Using a hardened harness and a grader, the researchers evaluated six models, including Claude Mythos Preview, Opus 4.8, and Opus 4.6. Mythos Preview autonomously produced eight working code‑execution exploits for 18 Firefox SpiderMonkey patches and eight full exploit chains for 21 Windows kernel patches, often within hours of the patch release. Other models generated fewer exploits and required longer times. The results indicate that the patch gap threat is larger than previously understood and that defenders must accelerate patch deployment to mitigate the growing risk posed by increasingly capable language models. The study underscores the need for improved defensive strategies and faster patch rollouts in the AI and cybersecurity communities.
Measuring LLMs’ impact on N-day exploits
Anthropic Research evaluated how large language models can accelerate the creation of N‑day exploits, focusing on Firefox’s JavaScript engine and Windows kernel patches. The study found that the most capable model, Claude Mythos Preview, autonomously produced eight working code‑execution exploits for Firefox patches and eight full exploit chains for Windows kernel patches, often within hours of the patch release. Other models produced fewer exploits and required longer times. The results suggest that the patch gap threat is larger than previously thought and that defenders must deploy patches more quickly.
Why it matters
The findings show that as language models improve, the time required for attackers to develop N‑day exploits shrinks, increasing the urgency for rapid patch deployment and stronger defensive tooling in the AI industry.