Notifications
Clear all
Topic starter
16/09/2026 9:21 am
TL;DR: Frontier AI can now find novel application flaws and generate working exploits faster than human teams, and Oligo Security says its runtime sensor blocked a controlled zero-day test while allowing the application to keep running. The practical lesson is that defenders need behavior-based intervention, not just vulnerability knowledge, because the discovery-to-exploitation window is shrinking toward zero.
NHIMG editorial — based on content published by Oligo Security: How Oligo Catches Zero-Days From Frontier Models
Questions worth separating out
Q: What breaks when an unknown application vulnerability is exploited before patching can happen?
A: Patch-first programmes break because they assume defenders have a discovery and remediation window.
Q: Why does runtime behaviour detection work better than signatures against zero-days?
A: Because signatures depend on prior knowledge, while runtime detection looks for abnormal behaviour in the moment.
Q: How should security teams reduce the impact of a code injection exploit in production?
A: Limit the privileges of the application runtime, isolate sensitive operations, and monitor for unexpected process and network behaviour.
Practitioner guidance
- Deploy runtime exploit interruption on critical applications Correlate process behaviour, syscall patterns, and network actions so unknown exploits can be stopped while the application continues to run.
- Map trust boundaries around evaluation and parsing primitives Identify where untrusted input can change execution path, then instrument those junctions for anomalous forks into file access, shell invocation, or outbound connections.
- Reduce blast radius for application runtime identities Constrain service accounts, API tokens, and workload permissions so code execution does not automatically become broad data access or lateral movement.
What's in the full article
Oligo Security's full article covers the operational detail this post intentionally leaves for the source:
- Walkthrough of the controlled exploit test and how the frontier model was used to generate the attack path
- Detailed explanation of the primitive fork that converted ordinary code execution into malicious behaviour
- Runtime detection logic and the sequence of signals used to block the exploit while the application kept running
- Discussion of why exploit-window compression changes the security model for AI-assisted vulnerability discovery
👉 Read Oligo Security's analysis of frontier AI zero-day detection and runtime blocking →
Frontier AI and zero-day exploitation: are runtime controls keeping up?
Explore further
16/09/2026 9:21 am
Runtime intervention is becoming the relevant control plane for unknown-exploit defence. Static vulnerability inventories matter, but they no longer define the full defender timeline when AI can shorten discovery-to-exploitation cycles. The control question shifts to whether the platform can recognise abnormal runtime behaviour fast enough to interrupt abuse before execution completes. For practitioners, that means treating runtime telemetry as an active security control, not just an observability layer.
A question worth separating out:
Q: Should organisations prioritise runtime protection before they finish patching zero-days?
A: Yes. When exploit creation accelerates, waiting for patch completion leaves too much exposure. Organisations should prioritise runtime controls for high-value applications, then use patching and code fixes to close the root cause. This is a sequencing decision, not an either-or choice, because both controls serve different phases of risk reduction.
👉 Read our full editorial: Frontier AI zero-day discovery raises the bar for runtime defence
