Nine of the vulnerabilities Apple fixed in its 17 August security release were found by OpenAI Codex Security, an AI system rather than a human researcher. That detail matters more than the patch count itself. If AI tools keep finding bugs at this pace, the gap between a vulnerability existing and a business patching it is about to get a lot smaller.
AI is now finding bugs faster than traditional research
Codex Security is credited alongside independent researchers in Apple’s own security notes for the update. AI-assisted discovery has moved from an experimental sideline into a routine part of how vulnerabilities surface. Apple is not unusual here. Across the industry, AI tools are being pointed at codebases for both attack and defence, discovering weaknesses and, increasingly, helping to fix them faster too.
Dr Logic flagged the underlying shift in April, when the National Cyber Security Centre’s chief executive described the gap between a vulnerability being disclosed and being actively exploited as compressing from days to minutes. Three Apple security releases in three weeks this August is that trend playing out in public, with a named AI tool now credited on the release notes.
Faster discovery means faster exploitation too
The same AI capability that finds a bug for a vendor to patch can find it for an attacker to exploit. Once a vulnerability is public, whoever moves first wins, and that first mover is increasingly likely to be automated. A business running a monthly or quarterly patch cycle is no longer behind by a few weeks. It is behind by the entire window in which the vulnerability was exploitable before anyone else even knew it existed.
Why manual patch cycles will not keep up
Scheduled update windows made sense when the average vulnerability had a predictable shelf life before exploitation. That assumption no longer holds. If patch cycles keep compressing industry-wide, waiting for a convenient maintenance window stops being a reasonable trade-off between stability and security, and starts being a straightforward gap in your defences.
What this means for Cyber Essentials
Cyber Essentials already requires timely patching as a baseline control, and assessors are increasingly unsympathetic to update policies built around quarterly reviews. Automatic, managed updates are no longer a convenience feature. They are becoming the only realistic way for most businesses to keep pace with how quickly vulnerabilities now surface and spread.
Dr Logic’s managed IT support keeps devices current automatically, so your Cyber Essentials patching control does not depend on someone remembering to click update.
