Written By | Torch Media Africa
Washington scrambles to build an AI "clearinghouse" as machines start finding — and weaponizing — security flaws faster than humans can blink
Search
WASHINGTON, D.C.
There is a new kind of clock ticking inside every bank, hospital and power company in America, and almost nobody outside the cybersecurity trenches has noticed it yet. It used to be that when a dangerous flaw was found in a piece of software, defenders had days — sometimes weeks — to patch it before criminals figured out how to break in. That clock has all but stopped.
This month, a cyber research lead watched a hacking crew take a freshly disclosed, critical software flaw and turn it into a working weapon aimed at government computer systems in just nine hours. Nine hours. Not nine days. Not nine weeks. Nine hours — less time than it takes most big companies to even convene the meeting where they decide whether a patch is urgent.
"Nine hours is faster than most patch approval processes even convene," Hido Cohen, the cyber research lead at security firm Dream who witnessed the attack, said bluntly.
Welcome to the strange, high-speed new war being fought inside the world's computers — a war where artificial intelligence is playing offense and defense at the same time, and where the White House itself has now been forced to build emergency machinery just to keep up.
THE BUG APOCALYPSE
For years, security experts warned that AI would eventually get good enough to hunt for software vulnerabilities on its own. That future arrived this year, and it arrived loud. Microsoft alone released fixes for more than 600 vulnerabilities this month in a single "Patch Tuesday" release — a record that stunned even veteran defenders.
"The bug apocalypse has fully descended upon us," said Dustin Childs, head of threat awareness at Trend Micro's Zero Day Initiative, in a stark public statement that has since been repeated across cybersecurity conference stages worldwide.
Industry researchers now expect roughly 66,000 confirmed software vulnerabilities to be catalogued in 2026 alone, according to tracking by the Forum of Incident Response and Security Teams — a staggering figure that reflects not just more scrutiny of software, but a fundamentally new kind of scrutiny. AI systems, according to threat researchers, are now finding roughly 25 confirmed vulnerabilities a day. Human developers, working around the clock, are managing to actually fix only about 1.5 a day.
Do that math and the picture gets ugly fast: for every bug that gets patched, more than sixteen new ones are discovered. The gap between "found" and "fixed" — what the industry is now calling the AI patch gap — is widening by the week, and every unpatched flaw sitting in that gap is a door left ajar for whoever gets there first.
"AI is making both defenders and attackers better at finding software flaws," is how one recent industry assessment summarized it, and it is not an exaggeration. The same technology that lets a security researcher scan a company's code overnight and flag a dozen dangerous weaknesses can, in the wrong hands, be pointed at the exact same code to build the exploit that breaks in.
Behind the scenes, the numbers on how long companies take to actually fix things paint an even bleaker picture. According to Verizon's annual data breach investigations report, the median time it took companies to patch critical bugs actually rose last year — climbing to 43 days, up from 32 days the year before. Humans, in other words, are getting slower at fixing things at precisely the moment machines are getting radically faster at breaking them.
Jen Easterly, the former director of the U.S. Cybersecurity and Infrastructure Security Agency, put the shift in stark terms in a recent public warning, cautioning that the government's own widely used database of actively exploited vulnerabilities — the Known Exploited Vulnerabilities catalog, or KEV — was built for a slower era and now needs to be rethought entirely.
"For widely deployed, internet-facing products, the period in which defenders can wait for confirmed exploitation before acting is shrinking," Easterly wrote.
Consider the evidence: cybersecurity firm Proofpoint identified a dozen distinct vulnerabilities disclosed this year that were already being actively exploited by attackers in real-world network attacks — but as of mid-May, only eight of those had even made it onto the government's official Known Exploited Vulnerabilities list. The bureaucracy of cataloguing danger, it turns out, cannot keep pace with the speed at which danger is now arriving.
WASHINGTON BUILDS AN EMERGENCY ROOM FOR THE INTERNET
Faced with this accelerating gap, the White House didn't wait around. In June, President Trump signed an executive order creating a sweeping new federal initiative, and on July 14 the administration formally unveiled its centerpiece: a program with the unmistakably patriotic codename "Gold Eagle."
Gold Eagle is, in essence, a triage ward for the entire American internet. It's a joint operation run primarily out of the Treasury Department, with the Cybersecurity and Infrastructure Security Agency, the Department of Homeland Security and the Pentagon all pitching in, alongside private cybersecurity firms, open-source software maintainers and companies that run the nation's power grids, banks and hospitals.
"Under President Trump's leadership, the Treasury Department is working hand in hand with the private sector to safeguard our financial institutions, close vulnerabilities, and protect the integrity of the U.S. financial system," Treasury Secretary Scott Bessent said in a statement announcing the program. "Treasury, along with our partner agencies, will continue to harness frontier AI capabilities to stay ahead of our adversaries and defend the American people from emerging threats."
The mechanics of Gold Eagle are almost as unusual as its mission. Rather than relying purely on human analysts, the government is turning to the very same frontier AI systems that are driving the vulnerability explosion in the first place. A senior White House official told reporters that closed-source frontier models — including Anthropic's newly released "Mythos" system, built specifically for cybersecurity work — will be used by the government itself to hunt for dangerous flaws before criminals do.
Working with Carnegie Mellon University's Software Engineering Institute, the administration built a new intake system called VINTS — the Vulnerability Information and Coordination Environment — designed to receive reports of AI-discovered vulnerabilities from companies and researchers around the country and funnel them toward the people who can actually fix them, fast.
"I think on the early side of this, we have seen that the scale of vulnerability discovery, particularly with users of new technology to scan their system, is something that is a step function change [than] we've seen before," a senior White House official told reporters on background.
Secretary of Homeland Security Markwayne Mullin has also signaled that the program isn't purely defensive bean-counting — it's meant to actively explore how AI itself can be turned into a shield, not just a scalpel for finding wounds.
Officials were careful to frame the effort as a partnership rather than a takeover. Open-source software — the free, publicly maintained code that quietly underpins huge swaths of the internet, from hospital record systems to power grid controls — has historically been an especially soft target, because so few organizations even keep track of which open-source components they depend on. When a flaw was discovered in 2021 in a widely used open-source logging tool called Log4j, it took a massive, monthslong coordinated effort involving CISA and the private sector just to identify everywhere the vulnerable code was hiding.
"It is being maintained by a talented group of people and entities and we will do everything we can to support the strength of that community," a senior administration official said of the open-source ecosystem Gold Eagle is meant to help protect.
Not everyone in the cybersecurity establishment is convinced Washington fully grasps what it's dealing with. Michael Daniel, who served as the White House's top cyber coordinator under President Obama, offered a note of caution to reporters, pointing out that policymakers are still in the early stages of understanding exactly what makes AI-driven threats different from the threats that came before.
"It may turn out at the end of the day that phishing is still phishing, and the fact that now you've got AI tools doing it, it's still phishing," Daniel said. "Or there may be something fundamentally different about it that we need to figure out how to combat and share information around."
A RACE THAT NEVER SLEEPS
What makes this moment genuinely unprecedented, according to the researchers watching it unfold, isn't just that AI can find bugs — it's that the entire tempo of cyber conflict has shifted from a human clock to a machine clock. Attackers no longer need teams of elite hackers spending weeks reverse-engineering a patch to figure out what it fixed and how to exploit the gap before customers update their systems. AI tools can do that reverse-engineering automatically, at a scale and speed no human team could match.
Some in the security industry argue the long-term trajectory actually favors defenders — that eventually, AI tools will be sophisticated enough to not just find and patch vulnerabilities but to write new code that is secure from the very beginning, closing the loophole before it ever opens. But nearly every expert interviewed for this story agreed on one grim point: that future is likely two to three years away, and the gap between AI-powered attackers and AI-powered defenders is going to get worse before it gets better.
In the meantime, security leaders are urging a strategic retreat to fundamentals. AT&T's chief information security officer, Rich Baich, and RSA Conference chair Hugh Thompson, argued in a recent joint call to the industry that the old model of patch-and-pray needs to give way to a much stronger emphasis on prevention itself — multifactor authentication, strict identity controls, and systems designed to assume that some attacker, somewhere, is already moving at machine speed.
"Our profession shouldn't be defined by how efficiently we observe compromise," Baich and Thompson wrote. "It should be defined by how effectively we reduce the likelihood of compromise in the first place."
WHAT THIS MEANS FOR YOU
If you're picturing this as a problem confined to Fortune 500 boardrooms and Pentagon briefing rooms, think again. The systems in the crosshairs of this AI-accelerated arms race are the same ones that keep your paycheck moving through your bank, your prescriptions filled at the pharmacy, and the lights on in your house. Gold Eagle's architects specifically called out financial institutions, hospitals and energy networks as the highest-priority targets for protection — precisely because those are the systems where a successful attack doesn't just mean stolen data, it can mean real-world disruption to daily life.
For ordinary people, the practical takeaway is less dramatic than the headlines but no less important: the advice security professionals have been repeating for years — unique passwords, multifactor authentication on every account that offers it, and quick installation of software updates the moment they're available — matters more now than it ever has. In a world where the gap between a flaw being found and being exploited can shrink to a matter of hours, the old habit of clicking "remind me tomorrow" on a security update is no longer a small risk. It's a race against a machine that doesn't sleep, doesn't get distracted, and doesn't take weekends off.
Consumers should also expect to hear a lot more, not less, about software vulnerabilities in the months ahead. Experts caution that the sheer volume of disclosed flaws — on pace to roughly triple what was typical just a few years ago — doesn't necessarily mean the internet is falling apart. It largely reflects the fact that, for the first time, defenders finally have tools powerful enough to see the full scope of a problem that was always there, hiding in plain sight.
THE BOTTOM LINE
The nine-hour exploit that alarmed cybersecurity researchers this month is not a one-off horror story — it's a preview of the new normal. Software vulnerabilities that once sat undiscovered for months, giving defenders a comfortable head start, are now being unearthed by the same AI tools available to attackers and defenders alike, and the side that moves fastest wins. Washington's Gold Eagle initiative represents the first real attempt by the U.S. government to fight AI-speed threats with AI-speed defenses, fusing the resources of the Treasury, Homeland Security, the Pentagon and the country's leading AI labs into a single early-warning system.
Whether it works will depend on something that has nothing to do with algorithms: whether humans, government agencies and private companies alike, can move fast enough to keep up with the machines they built. For now, the clock keeps ticking, and as one researcher warned, it's already ticking faster than most organizations know how to run.
Sources: CyberScoop, Axios, the White House, Verizon 2026 Data Breach Investigations Report, Help Net Security, and public statements from Treasury Secretary Scott Bessent, Trend Micro's Dustin Childs, Dream's Hido Cohen, former CISA official Jen Easterly, and former White House cyber coordinator Michael Daniel.
