What is a zero-day? The software flaws nobody knows about yet

In early September 2026, OpenAI said its new model, GPT-6 Astra, was the first of its models to reach “Critical”. That is the top level on the scale OpenAI uses to track how much harm an AI’s cybersecurity skills could do.

In OpenAI’s own tests, Astra found security flaws that nobody had spotted before, in widely used, well-protected software that included a web browser and the core of a computer’s operating system. OpenAI has not named the software, to lower the risk for computers that may not have been fixed yet.

Flaws like these have a name: zero-days.

A weak spot the makers haven’t found

Software often has security flaws. Experts call them vulnerabilities: weak spots an attacker could use to get in or cause harm. The trick or piece of code that uses a weak spot is called an exploit.

When the makers learn about a flaw, they write a fix, called a patch, and send it out in an update.

A zero-day is a flaw the makers don’t know about yet. The name comes from their side of the story: when they first hear of it, they have had zero days to fix it, and someone may already be using it. Until the fix exists, attacks that use the flaw are likely to work.

A four-panel comic. A gardener locks the garden gate with a padlock and says, All locked up! Behind the shed, a rabbit squeezes through a gap where a fence board is missing, under the caption, A gap nobody knows about. The gardener finds the gap, holding a lettuce, as the rabbit’s tail disappears through it, under the caption, Day zero: the gardener finds out. The gardener hammers a new board over the gap, under the caption, The patch. — An illustration: a zero-day is like a gap in the fence the gardener hasn’t found yet. The fix for a software flaw is even called a patch.

Once a flaw has been patched, it is no longer called a zero-day.

Who finds it first

A zero-day can be found by people who want it fixed or by people who want to use it.

Google has a security team called Project Zero whose stated mission is “making 0-day hard”. When it finds a flaw, it tells the company that makes the software, and under its rules the company gets 90 days to make a fix available. If it can’t, Project Zero normally makes the details public when the time is up. If attackers are already using the flaw against real people, the deadline shrinks to seven days.

Finding flaws can pay. Apple says it has paid more than $35 million to more than 800 researchers since 2020, and in late 2025 it doubled its top reward to $2 million.

On the other side, an exploit can be sold for a lot of money. Google’s threat researchers counted 90 zero-days that attackers used in 2025 before a fix was out, up from 78 in 2024. They say their count may not include every one.

When the finder is an AI

In late 2024, Google said its AI agent Big Sleep had found a flaw in SQLite, a free and widely used database program. Google reported it and SQLite’s developers fixed it the same day. The flaw never made it into an official release, so nobody using SQLite was affected. Google believed it was the first public example of an AI agent finding an unknown flaw like this in widely used software.

In July 2025, Google said Big Sleep had found another SQLite flaw, one that only attackers knew about and were about to use, and that Google had cut it off in time.

By OpenAI’s account, Astra goes further. In one test, people watched it work but were not allowed to give it any ideas. It found several unknown flaws in a web browser and joined them into a working attack. Its first success, after 29 hours, was on a version of the browser missing some of its usual protections. Asked to attack the official public version, it succeeded after 12 more hours. Afterwards, Astra wrote up reports and fixes, and OpenAI passed its findings to the makers.

A four-panel comic. A small green robot holds a magnifying glass over a long scroll of scribbled code, under the caption, 1. An AI reads the code. Under the magnifying glass, one spot on the scroll glows red with a crack, under the caption, 2. A flaw nobody knew about. The robot hands a folded report to two software makers at a desk, under the caption, 3. Tell the makers. A teenager on a sofa taps a button reading Update on a phone, under the caption, 4. The fix arrives as an update. — An illustration of the good ending: the flaw reaches the makers before it reaches an attacker.

The same skill works for both sides

A tool that can find a hidden flaw so it can be fixed can also find one to break in with. Google’s threat researchers expect AI to “accelerate the ongoing race between attackers and defenders” in 2026, helping attackers find flaws and build exploits faster, and helping defenders find and patch flaws before they are used.

OpenAI says it is limiting who gets Astra’s full security skills. In its tests, when asked to write a small attack that proves a flaw is real, the standard version of Astra finished 2.4% of the tasks. The version for checked security teams, given through a program called Daybreak, finished 92%.

The part you can do

You can’t hunt for zero-days yourself, but you control the last step. A patch only protects you once it is installed, and not everyone installs updates quickly.

When Apple released iOS 26.3 in February 2026, its notes said one of the flaws it fixed “may have been exploited in an extremely sophisticated attack against specific targeted individuals”. In other words, attackers may have used it before there was a fix.

The makers can write the patch, but only you can press update.

Back to the field notes