AI Is Shrinking the Time Businesses Have to Patch
When a software fix becomes the blueprint for the next attack.
For years, patch management has been a balancing act. Install updates too slowly and known vulnerabilities remain exposed. Install every update immediately and you increase the chances that a bad patch, failed installation, or unexpected reboot disrupts someone’s work. AI is changing that calculus.
That does not mean every exploit is now fully AI-made. It does mean the time between a vulnerability being understood and a working exploit being produced is getting shorter. For small and mid-sized businesses, that changes the way patching decisions need to be made.
One Click Was Enough
In September, security researchers at Volexity documented China-linked threat actors using a chain of vulnerabilities in Google Chrome and Microsoft Windows. In one campaign, the victim received a phishing email, clicked a link to what appeared to be a legitimate U.S. university website, and was redirected into the attackers’ exploit chain.
For a vulnerable Windows PC running Chrome, that single click could be enough. The chain compromised Chrome, escaped the browser sandbox, elevated privileges in Windows, and ultimately installed malware. No attachment needed to be opened. No installer needed to be run. No long sequence of bad decisions was required. The victim clicked a link.
Now imagine the same basic setup starting from something even more ordinary. A fake sticker gets placed over a QR code on a restaurant menu, parking sign, payment kiosk, or other public surface. You scan it, land on a malicious page, and from there the rest happens behind the scenes. The specific September exploit chain was Chrome and Windows, not a universal mobile takeover. But the underlying lesson is the same: it is getting easier to turn a normal user action into the start of a compromise.
The Patch Can Become the Blueprint
The September campaign also highlighted a second problem: the patch gap. One of the Chrome vulnerabilities had already been fixed in the open-source Chromium codebase before that fix had reached a normal Chrome release. In other words, information about the fix was public while many users were still vulnerable.
Attackers have long used a technique called patch diffing, where they compare the vulnerable version of software to the patched version to see what changed and work backward toward the flaw. That practice is not new. What is changing is how quickly AI can help perform work that previously demanded a narrower set of reverse-engineering skills.
Anthropic recently tested advanced AI models against 18 Firefox security patches. Its top-performing model produced eight working code-execution exploits, with the first completed in just under one hour. The researchers also tested 21 Windows kernel patches and got eight complete exploit chains that escalated from a low-privilege user to full SYSTEM access. Their conclusion was blunt: what used to be an N-day problem is increasingly becoming an N-hour problem.
That does not prove AI built the Chrome and Windows exploit chain used in the September attacks. It does show that the economics of exploit development are changing. As more of the hard work becomes faster and cheaper, more attackers can potentially participate, and they can do so on a shorter timetable.
Patching Is Becoming a Race
There is still no risk-free patching strategy. Updates can fail. Reboots interrupt people. Line-of-business applications can behave badly after a change. Every IT team knows that. But waiting has its own cost, and that cost is getting higher.
If published fixes can now help attackers move toward a working exploit in hours instead of days or weeks, businesses have less room to delay routine endpoint and browser patching. That does not mean blindly shoving every update into production the second it appears. It does mean the balance between patch speed and patch stability has shifted, and many organizations need to put slightly more weight on speed than they did before.
For most small and mid-sized businesses, the practical takeaway is straightforward. Keep patch cadence tight. Make sure machines are actually online often enough to receive updates. Plan for more reboots and some occasional inconvenience. And recognize that in today’s AI reality, working together on faster patching is often safer than holding out for perfect patch stability.
Frequently Asked Questions
Did AI create the September Chrome and Windows attack?
No public reporting has shown that the specific September exploit chain was created by AI. The concern is broader: multiple sources now show AI can speed up patch analysis and exploit development, which reduces the time defenders have to respond.
Why does this matter to SMBs?
Because SMBs usually do not have large security teams, duplicate staging environments, or long change windows. When the time from patch to exploit gets shorter, the margin for delayed patching gets smaller too.
Does faster patching mean more disruption?
Sometimes, yes. More frequent patching can mean more reboots and a higher chance of running into a bad update. That is the tradeoff. The point is that the security cost of waiting is rising, so the tradeoff has to be evaluated differently than it was a few years ago.
What should businesses do next?
Review patch cadence for browsers, Windows, and third-party applications. Make sure devices are not being left offline for long stretches. Confirm who is responsible for deployment, reboot coordination, and exception handling. And if your current approach is mostly manual, it is worth revisiting whether your patch process still fits the threat landscape.
Have a technology problem or question you’d like to discuss?
If your organization is trying to balance security updates, user disruption, and real-world business risk, Coeus Consulting can help you work through the tradeoffs.
Book time with Coeus Consulting
About Coeus Consulting
Coeus Consulting is a Phoenix-based managed IT services provider and MSSP serving small and mid-sized businesses across managed IT, cybersecurity, cloud, and compliance. We help organizations make practical technology decisions that improve resilience without losing sight of business reality.
About the Author
Linus Malefors
Managing Director, Coeus Consulting
Linus Malefors is an accredited technology consultant with over 30 years of experience serving Phoenix small and mid-sized businesses. He has supported more than 1,000 organizations throughout his career, and his leadership at Coeus Consulting has earned him two MSP Titans of the Industry finalist honors and a place among the 2026 AZ Champions of Change finalists. His technology expertise spans cybersecurity, cloud, AI, infrastructure, and regulatory compliance.
Sources referenced in this article: