Infosecurity Magazine reported on 19 October that a new Moody's report found slow patching of known exploited flaws. The median time to fix them was 87 days, so half stayed open after three months. For flaws with no known exploitation, the median was 107 days. Moody's used February 2026 data from Bitsight Technologies, covering flaws disclosed over the previous two years.
The report says AI agents can already exploit flaws and compromise systems within days. It points to containment failures in developer testing at OpenAI and Anthropic. OpenAI's case was an internal evaluation, not an attack by a threat actor. Moody's noted that no comparable attacker campaign has been publicly documented. It also cited the UK AI Security Institute, which put the gap between open-weight and frontier models at four to seven months, down from six to ten. Moody's said AI advances since February may have cut the time to exploit, and patch times may also have changed. The coverage gives no newer patch figures.
Moody's said companies with weak patching face the most credit risk, especially those with large digital networks. It added that smaller and mid-sized firms could become more worthwhile targets as AI lowers the cost of attacks. For teams that run or buy software, the 87-day figure is a measured benchmark for how long exploited flaws stay open.