zero-day vulnerability

basicwidespread

A security flaw in software that the vendor is not yet aware of, or for which no fix exists yet, so attackers can exploit it before anyone patches it.

In plain terms

Imagine a factory defect in your apartment lock that neither you nor the manufacturer knows about, but a burglar does. Until the manufacturer learns of it and replaces the lock, the burglar can come and go as they please. A zero-day vulnerability is the same in the software world.

The name indicates that the manufacturer had "zero days" to prepare: the flaw is already exploitable, but the fix does not yet exist. This distinguishes it from ordinary, known flaws for which an update exists and only needs to be installed.

Such flaws are very valuable. Criminals, spyware makers and state intelligence services all hunt for them, while vendors pay rewards to researchers who report a flaw to them instead of selling it on the black market.

Artificial intelligence has opened a new chapter: AI agents can now independently search for errors in program code. This helps defenders fix issues faster, but in the hands of attackers, it can equally become a weapon.

How it works

Someone finds an unknown bug in a program, a phone operating system, or a device. This could be a security researcher, a criminal, or increasingly often a debugging AI agent.
If the finder is malicious, they create a so-called exploit: a small program or cleverly edited file that enters the system through the vulnerability.
The attack goes unnoticed until someone spots the suspicious signs and the flaw comes to the manufacturer's attention.
The manufacturer fixes the bug and releases a security update (patch). The bug becomes public, usually receiving a standard registry identifier (CVE number), and since a fix now exists, it is no longer a zero-day.
The risk only disappears once you install the update; many attacks target those who delay for weeks or months.

An everyday example

Your phone displays a message tonight that an urgent security update is available, and in the news you read that the manufacturer fixed an "actively exploited" bug. This means attackers were already using the vulnerability before the fix was released. It is advisable to update on the same day.

Who is affected

everyoneSuch an error can occur on your phone, in your browser, or on your home router, and a quick update is the only thing you can do about it.

entrepreneur, executiveA zero-day attack can lead to data theft, ransomware, and shutdown, so update discipline and layered defense are needed even if the company is small.

developerA bug lurking in your code or in the external packages used makes your product vulnerable, and coding agents can both find bugs and create bugs. → Code

bank customer, investorThrough a bug in the phone or browser running the banking application, the attacker can access your money and data. → Money

A common misconception

MythIf I have antivirus software and always update, I am protected even against zero-day attacks.

In realityThe update only closes known bugs, and there is no fix yet for the zero-day vulnerability. Antivirus software also mainly recognizes known malware, not always the new ones. The update and antivirus are still important, but they can only reduce the risk, for example through cautious clicking, backups, and two-factor authentication.

Limits and risks

There is no complete protection: no one can say how many undiscovered bugs lurk in the programs you use daily.
Once the update is released, the details of the flaw quickly become public knowledge, so delay is most dangerous at that point.
Unsupported, legacy devices and programs do not receive fixes, leaving the flaw open permanently.
The debugging AI is a double-edged sword: it accelerates work for both defenders and attackers.

Similar, but not the same

known vulnerability – There is already a public description and usually a fix for known vulnerabilities, but not for zero-day ones.
exploit – The vulnerability is the bug itself, while the exploit is the tool or method used to take advantage of the bug.
virus, malware – Malware is the malicious program that gets delivered, while a zero-day vulnerability is merely the gap through which it can get in.

Related concepts

Broader

cybersecurity, vulnerability, cyberattack

Narrower

nulladik napi exploit, zero-day attack

On the edge

security update, bug-hunting program, ransomware, Spyware, prompt injection

A brief history

The term 'zero-day' moved from pirate software communities into the security profession. There, it originally referred to programs that were cracked and distributed on the very day of their release. It became widely known through Stuxnet, discovered in 2010. This malware exploited four previously unknown Windows vulnerabilities simultaneously against industrial control systems.

Where things stand

In late 2026, zero-day vulnerabilities are a constant feature of cybersecurity news, and major vendors regularly issue urgent patches for actively exploited flaws. What is new is that AI agents play an increasingly large role in finding these flaws, on both the defenders' and the attackers' side.

Status: 2026 November

In the news

Appears in 1 Agent Age stories; the curve shows weekly occurrence in the news magazine.

OpenAI CFO outlines AI-native finance function with zero-day closeAug 10, 2026 · Money

Also known as

zero-day vulnerability · nulladik napi hiba · zero-day attack · Zero-day vulnerability · zero-day · 0-day · zero-day exploit · zero-day vulnerability

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.