Patchmageddon Report Warns AI Is Outpacing Enterprise Patching

A July 2026 Patchmageddon report from Michael Cembalest says AI models are finding vulnerabilities faster than many organizations can patch them, with open source bearing early pressure. The report, cited in a post sponsored by Broadcom, includes input from J.P. Morgan Asset Management cybersecurity leadership.

The one-day exploitation clock

The report says models such as Anthropic's Mythos and OpenAI's GPT-5.5 now find previously unknown vulnerabilities at a scale no human research team can match. Anthropic and its Project Glasswing partners found more than 10,000 new high and critical severity zero-days in the first month alone. Median time from disclosure to first exploitation was roughly a year in 2021, down to one day in 2026 and projected to be one minute by 2027. Almost 80% of exploitations now land on or before public disclosure.

Open source takes the first hit

The pressure lands on open source first because open source is what modern software is made of and because its source is open for all to see. Of 530 high and critical severity findings Anthropic reported to open source maintainers by May 2026, only 75 had been patched. The report also notes that maintainers closed bug bounty programs and put up the gone fishing sign to de-stress. It highlights maintainer concentration: in a Linux Foundation and Harvard study of the top 50 open source projects, 23% had a single developer responsible for more than 80% of lines added, and 94% had fewer than ten developers writing more than 90% of the code. Anchore counted more than 18 million npm packages listing a single maintainer.

A plan for faster patching

The report says organizations will have to judge themselves on patching speed, not just accuracy, and that 90-day disclosure windows are now measured against a clock that runs in hours. It cites research finding that over 80% of security professionals have skipped a patch to avoid disrupting the business, and it argues that the unpatched system is now the bigger threat. J.P. Morgan's technology leadership is explicit: run current versions, and move off dependencies where you cannot identify who maintains them, where the maintainer looks like a one-person shop, or where the package appears abandoned. It says professional open source is backed by a vendor with skin in the game or a foundation with staffed security response, funded maintainers, and a release process that survives burnout. If you cannot name who maintains a package, you cannot count on anyone to fix it.

Change the proxy source, not developer habits

The post says most large companies already send every dependency download through an internal artifact proxy such as JFrog Artifactory or Sonatype Nexus. It argues that organizations can point the proxy at a supported source such as TrueSource without changing build files, URLs, or pipelines. The proxy can block known vulnerable versions and serve the nearest patched one instead, making the patched package the default. The post also recommends measuring how fast fixes reach production for the top 50 dependencies, knowing who maintains critical dependencies, and using AI to find and propose fixes while keeping people on the merge, ideally the code's maintainers.

Sources: The New Stack