AI models are starting to find real zero-days
Qualys found the RefluXFS Linux kernel flaw with help from an Anthropic model. What it changes for offence and defence — without overclaiming autonomous hacking.
- AUTHOR
- Karol Rapacz / CEO of Breachroad · OSCP · PNPT
- PUBLISHED
- 24 July 2026
- READING TIME
- 9 min read
- TOPIC
- AI Security
In July 2026 something happened that may matter more in the long run than another model launch: a research team found a real, exploitable Linux kernel vulnerability with the help of an AI model. Qualys disclosed RefluXFS (CVE-2026-64600) and, in describing the discovery, said it had used Anthropic’s Claude Mythos Preview, asking it to surface a flaw similar to the famous Dirty COW.
This is a good moment to describe the phenomenon precisely — without catastrophic headlines about “AI that hacks on its own.”
What exactly happened
Qualys described the process as a structured research collaboration. The model was asked to find a bug class similar to Dirty COW (a race condition in the copy-on-write mechanism). The direction it pointed to proved correct: the researchers then reproduced the bug themselves, confirmed it, and ran coordinated disclosure.
The result is a genuine vulnerability: a race in the XFS filesystem’s copy-on-write path, present in the kernel since version 4.11 (2017), letting a local user gain root on the default configuration of many enterprise distributions. We covered the operational side — who is affected and how to patch — separately in RefluXFS (CVE-2026-64600): local root on Linux.
Some context is worth adding: the same week, Qualys also disclosed the snap-confine flaw (CVE-2026-8933). Research teams are visibly accelerating.
What this story does NOT prove
Discipline is needed here. The model did not “hack” anything on its own. It did not autonomously write an exploit, did not carry out an attack, and did not replace the researchers. It did something narrower but valuable: it pointed to a promising direction within an enormous code space a human would have taken far longer to search.
This is consistent with what vendors themselves report about model capability. In the GPT-5.6 system card context, OpenAI classified its models as High capability in cybersecurity while noting that, in Chromium and Firefox testing, they did not independently build a full, working attack chain. In other words: models today are a strong amplifier of expert work, not a standalone attacker.
Why it shifts the balance anyway
Even as “just” an amplifier, the effect is significant, because it lowers the cost of finding bugs. A vulnerability class that required rare expertise and weeks of work becomes reachable faster and more cheaply. That cuts both ways:
On defence. Vendors and security teams can find their own bugs faster, before code ships. RefluXFS is an example — a flaw that existed since 2017 was found and patched before anyone reported exploitation.
On offence. The same capability is available to attackers with sufficient resources. The realistic assumption is that the time between a bug existing and being discovered will shrink — by anyone.
The practical consequence for companies is mundane: if flaws are found faster, then patching speed becomes an even greater advantage. A mature vulnerability-management process stops being hygiene and becomes an operational edge.
What to do about it
- Shorten your patch window. Since bugs will surface faster, your real protection is response time, not hope that your system is too niche to matter.
- Do not count on “security through obscurity.” Old, rarely reviewed code stops being safe merely because nobody wanted to read it.
- Use it on your side. Models are useful in code review and for flagging risky areas — as expert support, with results verified.
- Verify every model output. What was decisive in this story is that humans reproduced and confirmed the bug. Without that step you get hypotheses, not findings.
- Keep the disclosure process. Coordinated disclosure makes sense whether the bug was found by a human or a human with a model.
The bottom line
RefluXFS is the clearest public example yet that frontier models genuinely help find serious kernel flaws. This is not a story about autonomous AI attacking systems — it is a story about substantially accelerating researchers’ work. For defenders the conclusion is singular: if flaws will be discovered faster, the winner is whoever patches faster. If you want to see how quickly your organisation closes such windows, let’s test it together.
Sources: Qualys — RefluXFS (CVE-2026-64600), The Hacker News, Qualys — CVE-2026-8933.
