AI Zero-Day Vulnerability Detection 2026: Claude 4.5 and the New Security Frontier

Can AI find bugs that don't exist in any known database? It's already happening. Last November 2025, the cybersecurity startup RunSybil discovered a critical flaw in a customer's GraphQL deployment through its AI tool, Sybil. What makes this remarkable is that the issue required deep reasoning across multiple systems—knowledge that simply didn't exist on the public internet at the time.

Advancing AI Zero-Day Vulnerability Detection with Claude 4.5

We've reached an inflection point where frontier models are becoming exceptionally skilled at finding flaws. According to Dawn Song, a computer scientist at UC Berkeley, the combination of simulated reasoning and agentic AI—which can install tools and browse the web—has drastically amped up cyber capabilities. Recent benchmarks show a significant leap in performance over just a few months.

The Race Between Offensive and Defensive AI

In the CyberGym benchmark, which includes 1,507 known vulnerabilities, Anthropic's Claude 4.5 identified 30% of the bugs. While this is a win for security researchers, it's also a warning. The same low-cost intelligence can be used by hackers to generate malicious code and actions. Song suggests that frontier AI companies should share models with researchers early to find bugs before general release.