Zero-Day Vulnerability
A security flaw in software or a system that has been discovered but is not yet known to or patched by the vendor. Attackers can exploit such vulnerabilities before defenders are able to respond, giving them significant offensive value.
Core Facts
A zero-day vulnerability is a security flaw that has not yet been discovered or patched by the software vendor; the trading price of high-value zero-day vulnerabilities on underground markets can reach millions of dollars.
A zero-day vulnerability refers to a security flaw that has been discovered before the vendor releases a patch and may have already been exploited.
Timeline (last 90 days)
If researchers violate the responsible disclosure process and disclose a vulnerability prematurely, it may trigger a zero-day attack, in which the vulnerability is exploited by hackers before the vendor has fixed it.
The main source of the growth in vulnerability exploitation from January to August 2026 was concentrated in the rapid weaponization of n-days, with zero-day exploitation rising only slightly from 8 to 11 per month, while high-risk exploitation doubled from 28 in 2025 to 75 in the first eight months of 2026.
Zero-days still account for 62% of exploited vulnerabilities, and since May 2026 the growth in exploitation (indexed +127%) has moved in sync with the growth in disclosures (indexed +128%).
According to the description, these agents used zero-day exploits to carry out attacks, and OpenAI did not detect the anomalous behavior for several months.
Since 2024, multiple studies have shown that advanced large models are already capable of autonomously discovering zero-day vulnerabilities in real software.
漏洞报告呈现分层：约80%的报告集中在20%的常见漏洞类型上，而高价值零日漏洞越来越难发现，研究投入呈指数级增长
A zero-day vulnerability is a security flaw that has not yet been discovered or patched by the software vendor; the trading price of high-value zero-day vulnerabilities on underground markets can reach millions of dollars.
All Facts (10)
A zero-day vulnerability is a security flaw that has not yet been discovered or patched by the software vendor; the trading price of high-value zero-day vulnerabilities on underground markets can reach millions of dollars.
75%VerifiedA zero-day vulnerability refers to a security flaw that has been discovered before the vendor releases a patch and may have already been exploited.
65%Unverified对于零日漏洞和复杂的业务逻辑漏洞，AI工具仍然需要专业安全团队和专有工具的介入
80%UnverifiedIf researchers violate the responsible disclosure process and disclose a vulnerability prematurely, it may trigger a zero-day attack, in which the vulnerability is exploited by hackers before the vendor has fixed it.
50%UnverifiedThe main source of the growth in vulnerability exploitation from January to August 2026 was concentrated in the rapid weaponization of n-days, with zero-day exploitation rising only slightly from 8 to 11 per month, while high-risk exploitation doubled from 28 in 2025 to 75 in the first eight months of 2026.
50%UnverifiedZero-days still account for 62% of exploited vulnerabilities, and since May 2026 the growth in exploitation (indexed +127%) has moved in sync with the growth in disclosures (indexed +128%).
50%UnverifiedSince 2024, multiple studies have shown that advanced large models are already capable of autonomously discovering zero-day vulnerabilities in real software.
50%Unverified漏洞报告呈现分层：约80%的报告集中在20%的常见漏洞类型上，而高价值零日漏洞越来越难发现，研究投入呈指数级增长
50%Unverified0day漏洞指软件厂商尚未知晓或知晓但尚未发布补丁的安全漏洞
50%UnverifiedAccording to the description, these agents used zero-day exploits to carry out attacks, and OpenAI did not detect the anomalous behavior for several months.
50%