New AI models found more vulnerabilities than anyone at Palo Alto Networks expected — seven times more, in fact. The cybersecurity giant says it uncovered 75 flaws in its own products in a single month after it began using advanced AI cybersecurity models from Anthropic and OpenAI. For a company that typically discovers far fewer, the jump is striking.

Why This Matters

Palo Alto Networks is among the first organizations with early access to two powerful new tools: Anthropic’s Mythos Preview and OpenAI’s GPT-5.5-Cyber. That early access offers a rare glimpse at what some in the industry have started calling a looming “vulnpocalypse” — a period when AI dramatically accelerates the discovery of software flaws.

And the company isn’t treating this as a distant concern. Palo Alto Networks now estimates that organizations have just three to five months before attackers broadly gain access to the same frontier AI capabilities.

The Numbers Behind the Discovery

The scale of the difference is hard to ignore. Here’s what the company reported:

• Over the past month, it scanned more than 130 of its products for software flaws.
• That effort surfaced 75 legitimate vulnerabilities, all of which have since been patched.
• None of those vulnerabilities were being actively exploited in the wild.
• By comparison, the company normally finds and discloses an average of just 5 to 10 vulnerabilities per month.

In other words, the AI-assisted approach didn’t just edge past the usual rate — it blew past it by more than seven times.

What Made These Models Different

According to Chief Product Officer Lee Klarich, the standout capability wasn’t simply spotting individual bugs. It was the models’ ability to chain multiple flaws together into a working exploit path — something earlier AI systems consistently struggled with.

Klarich said the models were especially good at grasping the underlying “logic” of how applications worked, then figuring out how an attacker might exploit combinations of weaknesses. That distinction turned out to be significant. In several cases, individual flaws weren’t serious enough to warrant disclosure on their own — but when combined, they became high-severity vulnerabilities.

The models also proved capable on the offensive side. During internal testing, Palo Alto Networks found that they generated working exploits more than 70% of the time. As Klarich put it, the models are far better at writing functional exploits than anything the company had seen before.

A Reality Check: This Isn’t Magic

Impressive as the results are, Klarich was careful to temper expectations. Finding these vulnerabilities still required substantial human expertise and customization.

A few caveats stand out:

• The company experienced a false-positive rate of roughly 30%, though that figure varied widely depending on how researchers trained the models and what context they supplied.
• Significant effort went into building what Klarich called an “AI-scanning harness” — a system that feeds the models threat intelligence, context, and operational guardrails.

“These models aren’t magic,” Klarich said, explaining that the harness is what actually connects the model to whatever the team intends to scan. The takeaway: the AI is powerful, but it’s a tool that demands skilled hands to wield effectively.

The Bigger Picture

Over the past month, companies and governments alike have been scrambling to figure out how to defend against a future where attackers wield the same vulnerability-hunting power as models like Mythos and GPT-5.5-Cyber.

One useful insight from Palo Alto Networks: while Anthropic’s and OpenAI’s models are similarly powerful, they tend to surface different types of vulnerabilities. Because of that, Klarich recommends running multiple models in parallel to catch the widest possible range of flaws.

How Organizations Should Prepare

Palo Alto Networks is urging a four-pronged defensive strategy for the AI-assisted threat landscape:

• Find and patch first. Build the capability to discover and fix vulnerabilities before attackers can exploit them.
• Shrink the attack surface. Reduce internet-facing exposure so only essential systems remain publicly accessible.
• Automate detection and prevention. Deploy tools capable of blocking attacks in real time.
• Bring AI into the SOC. Integrate AI and automation into security operations centers so defenders can respond at machine speed.

The Bottom Line

The fact that new AI models found more vulnerabilities at such a dramatic rate is both encouraging and unsettling. For defenders like Palo Alto Networks, these tools offer a powerful head start in hardening their products. But the same capabilities will soon be available to attackers — and the company’s three-to-five-month estimate suggests the window to prepare is narrow.

The message running through Palo Alto Networks’ findings is clear: AI is about to reshape the pace of cybersecurity on both sides of the fight, and the organizations that adapt their defenses now will be the ones best positioned when the so-called vulnpocalypse arrives.