Topic starter
16/09/2026 9:21 am
TL;DR: Frontier AI can now find novel application flaws and generate working exploits faster than human teams, and Oligo Security says its runtime sensor blocked a controlled zero-day test while allowing the application to keep running. The practical lesson is that defenders need behavior-based intervention, not just vulnerability knowledge, because the discovery-to-exploitation window is shrinking toward zero.
Editorial analysis by NHI Mgmt Group, based on content published by Oligo Security: “How Oligo Catches Zero-Days From Frontier Models”.
Key questions
Q: What breaks when zero-day defence depends only on vulnerability knowledge?
A: It fails when the flaw is unknown before exploitation begins, because there is nothing to scan, catalogue, or patch in time.
Q: Why do unknown flaws increase the value of runtime security controls?
A: Unknown flaws remove the advantage of precomputed signatures, advisories, and patch queues.
Q: What are the signs that an application primitive is being abused?
A: Look for a trusted function taking input it should not accept, followed by unexpected file access, outbound connections, or process activity.
Practitioner guidance
- Instrument runtime exploit detection for application primitives Correlate code execution with operating system activity so unexpected evaluation, socket creation, and process behaviour can be blocked in context.
- Prioritise controls that preserve service continuity Test whether a runtime control can stop malicious branches while allowing legitimate application paths to continue, especially in production workloads.
- Rebuild zero-day response around exploit behaviour Treat unknown-vulnerability handling as a runtime containment problem, with escalation paths for active abuse rather than only delayed patching.
Bottom line: Frontier AI shortens the path from unknown flaw to working exploit, which weakens response models that depend on advance knowledge.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
16/09/2026 9:21 am
Runtime defence is becoming the decisive control plane for zero-day risk. When discovery and exploitation collapse into the same operational window, vulnerability knowledge alone stops being enough. Security programmes that still rely mainly on scanning and patch coordination are treating a speed problem as a visibility problem. Practitioners should assume exploit behaviour is now the first durable signal, not the CVE record.
A few things that frame the scale:
- CrowdStrike's 2026 Global Threat Report said zero-days exploited before public disclosure rose 42% year over year.
A question worth separating out:
Q: Should organisations prioritise runtime protection before they finish patching zero-days?
A: Yes. When exploit creation accelerates, waiting for patch completion leaves too much exposure. Organisations should prioritise runtime controls for high-value applications, then use patching and code fixes to close the root cause. This is a sequencing decision, not an either-or choice, because both controls serve different phases of risk reduction.
👉 Read our full editorial: Frontier AI zero-day discovery raises the bar for runtime defence