Zero-day Vulnerability

A zero-day vulnerability is a security flaw hidden inside software or a system that even the company that built it doesn't yet know about. The name "zero-day" comes from the fact that once the flaw becomes known to the world, the developer had zero days to fix it beforehand. Unlike known flaws that already have patches, a zero-day carries the risk that attackers discover it before defenders do.

Think of it like building a house where a hidden door was cut into a wall, one that never appeared on the blueprints. Neither the homeowner nor the architect knows it's there. If a burglar finds it first and sneaks in, the homeowner is caught off guard with no chance to react. When someone not only finds that door but also works out exactly how to open it and get inside, that finished method is usually called an exploit.

Recently, a new concern has emerged as AI models start to find these hidden doors faster and more accurately than humans can. The same capability is good news if defenders use it first to seal the hole, but it can lead to serious harm if attackers use it first — which is why AI companies handle models that show this kind of capability with extra caution.

In articles, it appears in conditions like: the model "should be able to identify zero-day vulnerabilities of all severity levels and develop functioning exploits across multiple hardened real-world critical systems without human intervention." Here, the zero-day vulnerability itself isn't some especially dangerous new kind of flaw — it refers to the ordinary flaws that always exist somewhere in any piece of software. The real issue is who finds it first and what they use it for.