For two decades, writing the exploit was the bottleneck in a cyberattack. AI made that step cheap, and patching hasn't gotten faster: - On average, attacks went from landing 63 days after disclosure in 2018-19 to 7 days before it in 2025 - A working exploit went from a skilled person's month to a few hours of machine time - The median time to fully fix a known-exploited bug rose to 43 days a16z's @asaf_ez and @steph_zhang expect a long, expensive worm era, hitting hardest where systems can't update fast: hospitals, schools, small water systems. "When attacking is nearly free, attackers no longer need to want a target." Full piece from Asaf Ezra and Steph Zhang: https://www.a16z.news/p/the-exploit-was-the-bottleneck