The discovery stage then examines entry points, data flows, and surrounding code context. Agents generate multiple vulnerability hypotheses, investigate them independently, and challenge one another’s conclusions. Evidence is synthesized into candidate findings, while consultants reproduce proof-of-concept exploits before a flaw is treated as verified.

That structure matters because it separates coverage from judgment. One agent can search broadly, another can pursue an attack path, and another can attempt to disprove the result. Human validation remains a final control against false positives and incorrect assumptions about how the software operates.

What Mandiant says AVDH has found

Google says AVDH has been used internally for about ten months and has uncovered dozens of assignable flaws in widely used web extensions and open-source projects. The work has resulted in 12 assigned CVEs, with roughly another dozen vulnerabilities undergoing active disclosure.

In one incident-response investigation involving stolen corporate repositories, external reporting says the harness helped identify more than 100 verified high-severity vulnerabilities in two days.

These numbers show the potential scale of AI-assisted review, but they should be read carefully. They are operational results reported by Mandiant and related coverage, not an independently audited comparison with conventional security testing. The findings also should not automatically be described as active zero-day exploits: a newly discovered or previously unreported vulnerability is not necessarily being exploited in the wild.

Palo Alto’s NOVA combines multiple models for vulnerability discovery

Palo Alto Networks’ Unit 42 describes NOVA—the Network and Open-Source Vulnerability Analyzer—as an autonomous discovery, validation, and reporting system powered by proprietary agentic harnesses and multiple frontier AI models.

In the company’s reported test, NOVA analyzed 3,915 open-source projects in two months and identified 14,090 previously unknown vulnerabilities. Unit 42 says 99.4% had not previously been reported and about 40% were rated high or critical.

The system’s significance is not only the volume of findings. Reporting on the results says many were semantic or logic flaws rather than the memory-corruption bugs traditionally associated with automated analysis. These can include mistakes in access control, path handling, server-side request behavior, or code-injection defenses—areas where understanding intended application behavior is essential.

As with AVDH, the headline figures are vendor-reported. “Previously unknown” does not by itself establish that every result is a practically exploitable zero-day, and severity classifications can depend on the scoring framework used. The more defensible conclusion is that multi-model agent systems are becoming capable of surfacing large numbers of security candidates that conventional review processes may not examine as quickly.

Why discovery alone is not enough

Finding vulnerabilities faster can increase defensive capacity, but it can also widen the crisis if organizations still rely on slow remediation cycles. CERT-EU cites an estimated mean time to exploit of negative seven days, meaning exploitation may begin before a patch is broadly available.

That metric changes the role of patching. A permanent code fix remains necessary, but it may no longer be the first or only useful defensive action. Security teams also need to reduce exposure while developers investigate, test, coordinate disclosure, and complete staged deployment.

Palo Alto’s program adds network-level containment

Palo Alto’s Frontier AI Critical Defense Program is designed to coordinate AI labs, software and open-source organizations, and sectors such as operational technology and healthcare around that problem. Its proposed response is to deploy network-level “virtual patches” that block exploit traffic or abusive protocol behavior before a permanent software fix is available.

Palo Alto says its Advanced Virtual Patching capability can deploy protections in hours, compared with a claimed industry average of 55 days for a conventional patch.

A virtual patch is best understood as a compensating control, not a replacement for fixing vulnerable code. Its effectiveness depends on whether the security team can accurately identify the exploit path and whether the network control can block that path without disrupting legitimate activity. Coverage can also be limited when attacks occur through trusted channels, encrypted traffic, local privilege escalation, or behavior that is difficult to distinguish from normal use.

Can defenders regain the advantage?

Possibly—but not simply by adding an AI scanner.

The stronger defensive architecture links several stages into one operating loop:

1. Map the code and attack surface so agents understand what the system does.
2. Build and review a threat model before large-scale hypothesis generation.
3. Use multiple agents and models to search from different perspectives and challenge weak findings.
4. Reproduce and prioritize vulnerabilities with human experts and evidence of exploitability.
5. Disclose and develop a permanent fix through the appropriate coordination process.
6. Contain the exposure immediately with network controls or other compensating measures.
7. Verify remediation after the software patch is deployed.

This is the strategic lesson from AVDH and NOVA: the advantage comes from orchestration, not from model output alone. AI can compress discovery and validation, but defenders still need trustworthy evidence, careful prioritization, resilient architecture, and deployment systems that act at the same pace.

Attackers can use comparable models, and virtual patches are temporary and coverage-dependent. The realistic goal is therefore not to eliminate zero-day risk. It is to make the defensive loop—from discovery to containment to remediation—faster and more reliable than the attacker’s path from finding to exploitation.

The discovery stage then examines entry points, data flows, and surrounding code context. Agents generate multiple vulnerability hypotheses, investigate them independently, and challenge one another’s conclusions. Evidence is synthesized into candidate findings, while consultants reproduce proof-of-concept exploits before a flaw is treated as verified.

That structure matters because it separates coverage from judgment. One agent can search broadly, another can pursue an attack path, and another can attempt to disprove the result. Human validation remains a final control against false positives and incorrect assumptions about how the software operates.

What Mandiant says AVDH has found

Google says AVDH has been used internally for about ten months and has uncovered dozens of assignable flaws in widely used web extensions and open-source projects. The work has resulted in 12 assigned CVEs, with roughly another dozen vulnerabilities undergoing active disclosure.

In one incident-response investigation involving stolen corporate repositories, external reporting says the harness helped identify more than 100 verified high-severity vulnerabilities in two days.

These numbers show the potential scale of AI-assisted review, but they should be read carefully. They are operational results reported by Mandiant and related coverage, not an independently audited comparison with conventional security testing. The findings also should not automatically be described as active zero-day exploits: a newly discovered or previously unreported vulnerability is not necessarily being exploited in the wild.

Palo Alto’s NOVA combines multiple models for vulnerability discovery

Palo Alto Networks’ Unit 42 describes NOVA—the Network and Open-Source Vulnerability Analyzer—as an autonomous discovery, validation, and reporting system powered by proprietary agentic harnesses and multiple frontier AI models.

In the company’s reported test, NOVA analyzed 3,915 open-source projects in two months and identified 14,090 previously unknown vulnerabilities. Unit 42 says 99.4% had not previously been reported and about 40% were rated high or critical.

The system’s significance is not only the volume of findings. Reporting on the results says many were semantic or logic flaws rather than the memory-corruption bugs traditionally associated with automated analysis. These can include mistakes in access control, path handling, server-side request behavior, or code-injection defenses—areas where understanding intended application behavior is essential.

As with AVDH, the headline figures are vendor-reported. “Previously unknown” does not by itself establish that every result is a practically exploitable zero-day, and severity classifications can depend on the scoring framework used. The more defensible conclusion is that multi-model agent systems are becoming capable of surfacing large numbers of security candidates that conventional review processes may not examine as quickly.

Why discovery alone is not enough

Finding vulnerabilities faster can increase defensive capacity, but it can also widen the crisis if organizations still rely on slow remediation cycles. CERT-EU cites an estimated mean time to exploit of negative seven days, meaning exploitation may begin before a patch is broadly available.

That metric changes the role of patching. A permanent code fix remains necessary, but it may no longer be the first or only useful defensive action. Security teams also need to reduce exposure while developers investigate, test, coordinate disclosure, and complete staged deployment.

Palo Alto’s program adds network-level containment

Palo Alto’s Frontier AI Critical Defense Program is designed to coordinate AI labs, software and open-source organizations, and sectors such as operational technology and healthcare around that problem. Its proposed response is to deploy network-level “virtual patches” that block exploit traffic or abusive protocol behavior before a permanent software fix is available.

Palo Alto says its Advanced Virtual Patching capability can deploy protections in hours, compared with a claimed industry average of 55 days for a conventional patch.

A virtual patch is best understood as a compensating control, not a replacement for fixing vulnerable code. Its effectiveness depends on whether the security team can accurately identify the exploit path and whether the network control can block that path without disrupting legitimate activity. Coverage can also be limited when attacks occur through trusted channels, encrypted traffic, local privilege escalation, or behavior that is difficult to distinguish from normal use.

Can defenders regain the advantage?

Possibly—but not simply by adding an AI scanner.

The stronger defensive architecture links several stages into one operating loop:

1. Map the code and attack surface so agents understand what the system does.
2. Build and review a threat model before large-scale hypothesis generation.
3. Use multiple agents and models to search from different perspectives and challenge weak findings.
4. Reproduce and prioritize vulnerabilities with human experts and evidence of exploitability.
5. Disclose and develop a permanent fix through the appropriate coordination process.
6. Contain the exposure immediately with network controls or other compensating measures.
7. Verify remediation after the software patch is deployed.

This is the strategic lesson from AVDH and NOVA: the advantage comes from orchestration, not from model output alone. AI can compress discovery and validation, but defenders still need trustworthy evidence, careful prioritization, resilient architecture, and deployment systems that act at the same pace.

Attackers can use comparable models, and virtual patches are temporary and coverage-dependent. The realistic goal is therefore not to eliminate zero-day risk. It is to make the defensive loop—from discovery to containment to remediation—faster and more reliable than the attacker’s path from finding to exploitation.