Zero-day explained — why an unpatched flaw is the most expensive thing in security
A zero-day is a software vulnerability for which no patch exists, so conventional defences have nothing to match against — which is where its value comes from
The three lines
- The name refers to the days a vendor has had to fix it: zero
- Once a patch ships it becomes an N-day and its value collapses — scarcity is not the point, defencelessness is
- Finding them has been elite manual work; automating that changes the cost structure of attack
Key questions
- What does zero-day actually mean
- A security flaw in software for which no fix yet exists. The name comes from the number of days the vendor has had to respond: zero. It describes the state of the defence rather than the severity of the bug — however dangerous a flaw is, once a patch is released it is no longer a zero-day.
- Why are they so valuable
- Because nothing blocks them. Antivirus and intrusion detection work from known patterns, and an unknown flaw has none. That makes a zero-day the only door into well-defended targets — government networks, financial systems, fully patched phones. The value has an expiry date: it collapses the moment the vendor ships a fix.
- Why does AI finding them change things
- Because the scarcity of the people who can do this work has functioned as a defence in itself. If only a few hundred people worldwide can find a zero-day in hardened software, there is a ceiling on how many such attacks can run at once. Automation removes the ceiling. That is why OpenAI paused parts of its Astra model in August after internal evaluations suggested it could find and exploit such flaws autonomously.
"Zero-day" appears in security coverage more often than almost any other term, and is misunderstood almost as often. It is usually treated as a synonym for "very bad hack." What it actually describes is the state of the defence, not the severity of the flaw.
1. The name means the vendor had zero days
All software contains defects; the ones that affect security are vulnerabilities. Their life cycle runs roughly like this.
| Stage | State | Can it be defended against |
|---|---|---|
| 1. Exists | The flaw is in the code, unknown to anyone | — |
| 2. Found | Someone discovers it — researcher, attacker, agency | Depends on the finder |
| 3. Zero-day | Vendor unaware, or aware with no patch available | Effectively no |
| 4. Patch shipped | Vendor publishes a fix | Yes, if you update |
| 5. N-day | Patch exists, users have not applied it | Depends on the user |
The term comes from stage 3: zero days of possible response.
And here is the fact most coverage buries. The overwhelming majority of real-world damage happens at stage 5, not stage 3. Systems running months- or years-old unpatched software account for the bulk of successful intrusions — which is why the US Cybersecurity and Infrastructure Security Agency maintains a catalogue of known exploited vulnerabilities with binding remediation deadlines.
2. Where the price comes from
A zero-day's value is not about rarity. It is about defencelessness.
Security products work from what is known. Antivirus matches signatures of known malware; intrusion detection matches known attack patterns. A flaw nobody knows about has no signature, so exploitation looks like normal operation.
That makes a zero-day the only entry into a well-defended target — and "well-defended" is doing the work in that sentence. Weak systems fall without one. Fully patched phones, air-gapped government networks and layered financial systems are where the value exists, because nothing else gets in.
| Market | Character | Rough price band |
|---|---|---|
| Bug bounty | Vendor pays the researcher, patch follows | Thousands to hundreds of thousands of dollars |
| Government / defence brokers | Sold to agencies; patching delayed | Hundreds of thousands to millions (published broker offers) |
| Criminal markets | Sold to criminal groups | Undisclosed |
The same bug has opposite effects on the world depending on which market it enters. Through a bounty, it is patched within days and everyone becomes safer. Through a broker, the door stays open for months or years.
3. What automation would change
Zero-day discovery has been elite manual labour: deeply understanding a target's internals, running enormous numbers of malformed inputs, and iterating through failure for weeks or months. The scarcity of people who can do it has functioned as a defence. If only a few hundred people in the world can produce a working exploit against hardened software, the number of such campaigns running simultaneously is capped.
Automation lifts the cap. On August 7 OpenAI paused parts of the development of its next-generation model, Astra, after preliminary internal evaluations indicated it might autonomously identify and exploit zero-day vulnerabilities in hardened, real-world systems — corresponding, under the company's own taxonomy, to the top "critical" tier of cyber capability.
There is a symmetry worth holding onto. The same capability points at defence: a system that audits its own code and fixes flaws before release uses exactly this skill, and if that deploys first, the total stock of exploitable vulnerabilities falls. The question is not whether the capability exists but which side reaches scale first.
4. What an individual can actually do
Honestly, very little about zero-days themselves — by definition there is no defence. What works is stage 5.
- Turn on automatic updates. Most real damage comes from patches that existed and were not applied.
- Use two-factor authentication. A second gate cuts success rates sharply regardless of the entry method.
- Remove software you do not use. Every installed program is attack surface.
- React to out-of-band patches. When a vendor ships an unscheduled emergency update, there is usually a reason.
5. What remains unverified
Price ranges here come from published broker offers and industry estimates; actual transactions are not disclosed. And as of writing there is no publicly confirmed case of an AI autonomously discovering and exploiting a zero-day in the wild — OpenAI's determination rests on internal evaluation, not an external audit or an observed incident.
OpenAI's decision is covered in today's companion piece, "OpenAI hit the brakes on its own model." The evaluation-awareness problem is in "AI walked out of the exam room." Government pre-release review is in "Thirty days before launch, the government looks first." This reference is updated as the field moves.