Zero-Day Discovery

Every major computer program contains bugs. Some of these bugs are harmless, others can be abused to break into someone else’s system. Such dangerous bugs are called security vulnerabilities. A zero-day flaw is a security vulnerability that the company that built the program doesn’t yet know anything about. Zero-day discovery is the process by which someone finds such a flaw — be it a researcher, an attacker, or nowadays even a computer program that searches for it automatically. The name comes from the fact that the manufacturer has zero days of head start: at the moment the flaw becomes known, no fix yet exists.

What makes an unpatched flaw so dangerous

A simple remedy helps against most attacks: installing updates. An update that closes a flaw is called a patch. With a zero-day flaw, however, this protection doesn’t work. There’s simply nothing to install, because the manufacturer doesn’t yet know about the problem. Anyone who knows the flaw can therefore use it against practically every system the software runs on.

This is what makes such finds valuable. For a serious flaw in a widely used phone operating system, specialized firms pay amounts in the six to seven figures. Buyers include intelligence agencies and vendors of surveillance software, among others. At the same time, manufacturers like Google, Apple, or Microsoft pay rewards to researchers who report flaws to them. These programs are called bug bounties — essentially a “bounty on bugs.”

The consequences can extend far beyond individual users. In 2017, the malware WannaCry spread via a Windows flaw and crippled, among other things, hospitals in the United Kingdom. Such incidents show that this isn’t just about stolen passwords, but about infrastructure that people depend on.

From fuzzing to AI-assisted code auditing

A classic method is called fuzzing. Here, a program throws masses of random or deliberately malformed inputs at the software being tested. One then observes whether it crashes. A crash is often the first indication that the program is doing something with data that it shouldn’t. After that, the real work begins: figuring out whether the bug can be exploited in a controlled way.

Alongside this, there is manual analysis. Experts read the source code or break down the finished program into its machine instructions. This is slow and requires a lot of experience. This is precisely where large language models now come into play — AI systems that can process text and program code. They read code considerably faster than a human and recognize suspicious patterns.

In 2024, Google’s Big Sleep project reported the first find in which an AI system discovered a previously unknown flaw in widely used database software. A common misconception is that the AI works alone here. In reality, it pre-screens suspected cases that a human must then confirm. Many reports are false alarms, so-called false positives.

Between bug bounties, exploit trading, and regulation

In the news, the term usually surfaces when a manufacturer releases an emergency update. Phrases like “is already being actively exploited” mean that attackers knew about the flaw before the manufacturer did. For users, the response is then very simple: install the update immediately, not next week.

The term is economically interesting because of the market behind it. Companies like Zerodium have published public price lists for zero-days for years. Controversial spyware vendors, for instance those around the Pegasus program, bought such flaws. Governments are increasingly trying to regulate this trade, because the same flaw can be used against journalists just as much as against criminals.

Zero-day discovery should be distinguished from the term exploit. The discovery is the finding of the vulnerability; the exploit is the finished tool that takes advantage of it. Not every flaw that is found can even be developed into a working attack. And as soon as a patch exists, the flaw is no longer a zero-day — but it remains dangerous for everyone who doesn’t install the update.