Chainguard's Patrick Smyth Says the Patch Now Arrives Seven Days After the Exploit

For two decades, software security has operated on a quiet bargain: when a serious flaw turns up, defenders get a head start. Attackers need time to build a working exploit; you use that window — typically 30 days, sometimes 60 or 90 — to patch.

Patrick Smyth says that head start is gone. At Chainguard, a software supply-chain security firm, he studies the gap between when a vulnerability gets exploited and when a fix ships. In 2018 and 2019, he said on the AI Engineer podcast, patches arrived on average 63 days before exploitation. The margin narrowed through 2021 and 2022 — a long trend he ties to rapid digitization, with institutions like hospitals suddenly running Python — and then, in his telling, the buffer simply "just kind of left" in 2023, 2024 and 2025. The current figure he cites is negative seven days : on average, the attack now lands before the fix exists.

He is careful to call the number noisy, since it is an average, but treats the direction as the whole story. The driver is frontier AI models, which he says are extremely good at combining several small, individually minor bugs into a single working attack. That capability is what floods the world with new zero-days.

The 30-day patch window may as well be a million years

The practical casualty is the classic remediation timeline. Smyth walks through the old model: scan your stack with tools like Grype or Trivy, get a list of vulnerabilities rated critical, high, medium and low, hand it to a team and give them 30 days. Against attackers who move on known flaws almost immediately, he said, "30 days may as well be a million years."

Even the scanners are now targets. Trivy, he noted, "had a bad year" and was itself attacked.

Everyone moves up a threat level

Smyth frames the new threat model as a ladder: in the AI era, "everyone kind of goes a level up." A single engineer now operates like a team; a small team now operates at the scale of an advanced persistent threat — the kind of disciplined, well-resourced intruder that once required state backing.

He supports this with three cases from the past year. A 17-year-old high schooler in Osaka used ChatGPT to write scripts, exfiltrated roughly 4.4 million records from Japan's largest internet cafe chain, then used a stolen card to buy Pokémon cards. Smyth's aside: "people can be very smart and very dumb at that age." A semi-technical individual known as FunkSec, thought to be Algerian, hit 85 targets over a few months. And an unidentified lone attacker used Claude Code against 17 organizations across healthcare, government and major corporations — not just to break in, but to write ransom letters, pick the target, organize files and run the attacks themselves.

The through-line is that capable tooling has collapsed the skill and headcount a campaign requires. What used to take an organization now takes a person.

Supply-chain worms went from monthly to daily

Smyth used to build a "meme calendar" of supply-chain attacks — one big incident per month. That cadence is now obsolete; he says he could "do a meme calendar of every day." He highlights four incidents, three of them from March 2026:

Trivy — the vulnerability scanner itself was compromised.

LiteLLM — a router for AI agents.

Axios — an attack live for only two hours that still reached 600,000 downloads .

Shai-Hulud — a JavaScript-ecosystem worm (named for the Dune sandworm) that proved a large-scale worm was viable, spawned many copycats, and produced a "Sandworm mode" variant.

The mechanism he stresses is chaining: because everyone depends on everyone else's packages, compromising one maintainer cascades down to their consumers. He also notes that some attacker code contains amusing naming and , though he cautions against being too entertained by it.

The problem is structural, not a skill gap

Smyth reduces supply-chain security to a simple shape. You have users who rely on your infrastructure and to whom you owe a responsibility. You, in turn, pull from upstream — repositories and maintainers you try to vet but cannot fully control. Anything you pull in can compromise you and, through you, your users. Everyone sits in this "rock and a hard place."

He frames the shift through the lens of "eternal September" — the moment when polite, high-trust university networks were flooded each September by new students who didn't know the norms. Environments naturally drift from high-trust to adversarial low-trust, he argues, and that drift is now permanent and accelerating.

The corollary is what he calls the iceberg problem. Perhaps only 1% to 2% of the code you run is your own application code , in his estimate. The operating system, the language runtime and the application layers beneath carry most vulnerabilities and sit mostly beyond your control. He calls the resulting bind "the 'my boss told me to fix Ubuntu' problem."

Attackers have moved to the side doors

The front door — production code — is comparatively well defended, so Smyth says attackers now target the layers nobody watches: CI/CD pipelines, which are misconfigured, dependency-heavy and under-scrutinized; developer workstations; and the new, fast-changing agentic layer.

The developer laptop is his favorite illustration. "You have a cooldown period, but does your developer workstation's laptop have the cooldown period? No. So let's attack the developer laptop." A cooling-off rule on your build system means nothing if a developer's machine pulls a malicious package directly — and macOS stealers, he notes, are the evidence.

He maps the threat into four buckets that need different defenses:

Chainguard's answer: rebuild the base layer, sign everything, airlift source

Smyth presents his company's products as direct responses to each surface. The foundation is Wolfi , a Linux distribution built from scratch since 2021 as a rolling release with little upstream beyond maintainers' own code. Images are rebuilt one to four times a day ; the company deliberately does not sit on stable versions, and keeps images minimal, which he says also shrinks zero-day exposure.

The remediation promise is 1 / 7 / 14 days : one day for known-exploited vulnerabilities, seven for criticals, fourteen for everything else. "This is our SLA," he said. "So no 30, 60, 90. It's 1, 7, 14." He notes that under the old model many teams would never triage mediums and lows at all.

On the malware front, Chainguard Libraries takes clean upstream source and rebuilds it in-house. "Most attacks are after source, and then between the source and the distribution of the artifact," he said. "So we take the source, we airlift it out of the maintainer's situation... we build it all, and then we pass it on to you." The point is structural: pulling from Chainguard's own pipeline instead of PyPI, NPM or Maven Central makes whole classes of post-source attacks impossible , not merely detectable.

On zero-days, the Athena consortium acts as a clearinghouse: known zero-days are collected and shared back to members. Smyth says the work is being done with major banks and tech companies — a collaborative model for a threat no individual firm can handle alone. On side doors, Chainguard Actions (free to try, drop-in for GitHub Actions) and Chainguard Agent Skills harden third-party CI/CD actions and agent skills.

He also makes a non-product argument he says the company cares regardless: sign everything with Sigstore and attach SLSA provenance , then verify the signature at the other end. That yields effective zero-trust pipelines and defends against the tag-tampering, download-page and dependency attacks that dominate the current landscape.

Agent skills are a live infection vector

Smyth's most striking statistic concerns the agent-skill ecosystem. By his own recent analysis, roughly 5% of agent skills on upstream repositories are actively malicious , and another 30% to 40% carry serious security issues even when not intentionally malicious. Earlier in the year, he says, the malicious was 20%.

Chainguard Agent Skills hardens upstream third-party skills and also lets organizations upload their own for hardening and internal discovery.

Smyth's close is blunt: "it's time to get serious," because the environment is materially more hostile than in 2023 or 2024. His priority list is to enforce cooldown periods on packages; remediate CVEs faster than ever; sign artifacts with Sigstore and SLSA provenance; harden developer laptops, including physical security keys; finish containerization and CI/CD projects, which he argues are now prerequisites for everything else (and where AI can help teams leapfrog); and stand up a golden-images program and centralize containers.

He flags upcoming Chainguard events: Assemble London that week, and an Open Source Finance Forum on November 5, 2026, with CEO Dan Lorenc and Athena consortium leaders. He closes on Wolfi the octopus — "the smallest octopus in the world," the size of a fingernail — as a mascot for minimality.

The synthesis Smyth is selling is coherent: AI has accelerated both code production and attack capability, the patch-before-exploit assumption is dead, and the durable response is to shrink and harden everything beneath your own application code.

The open question: who pays for all this?

The unresolved tension is cost and feasibility. Smyth concedes the work "costs" and "is painful." His own numbers — 1% to 2% of code is yours, 5% of agent skills are malicious — imply a defense surface far larger than most teams can staff.

That gap is already visible in the wider market. A critical flaw in PHP, the language running an estimated 70% of the web, triggered millions of exploitation attempts within roughly a day of disclosure in late October, according to Cloudflare's Matthew Prince — tens of thousands within 45 minutes of the public announcement and hundreds of thousands within two hours, forcing several governments to take sites offline as a precaution. The NSA and FBI told organizations that couldn't patch to take their sites down. Chainguard itself became part of that story: the PHP Foundation said the firm "unilaterally broke the embargo" by releasing details early, and CEO Dan Lorenc apologized and said he shared the information early because the flaw was already being exploited.

That episode is a test of Smyth's thesis in miniature. If exploits genuinely outrun patches, then coordinated disclosure — the mechanism that gives defenders their head start — is itself under pressure, and the case for pre-hardened, rebuilt-from-source infrastructure gets stronger. But it also shows the cost of getting it wrong.

Consider what it implies for investors. Security budgets have historically been set by compliance and by fear after an incident. If Smyth's numbers hold, the relevant spend shifts from detection to prevention at the base layer: minimal container images, signed build artifacts, dependency rebuilds, and shared zero-day intelligence through consortiums like Athena. That favors vendors selling hardened base images and pipeline security, and it pressures every company that ships software to account for the 98% of code it did not write. The question worth tracking is whether consortium models like Athena and drop-in hardened actions close that gap — or merely move the burden — and whether the negative patch window persists or reverts as defenders adopt the same frontier tools. Whichever way it goes, the 30-day patch cycle now looks less like a policy and more like a relic.

US Stocks: All Three Major Indexes Rise as SpaceX and Super Micro Earnings Lift AI Shares

Trump Announces Ban on Term "Artificial Intelligence," Pushes "Superintelligence" as New Name