AI-Driven Threats Highlight Patching Challenges at OPM

• •AI is reducing the time between vulnerability discovery and exploitation from months to hours.
• •Only 26% of known exploited vulnerabilities have been fully patched by organizations.
• •OPM is enhancing its cybersecurity posture through AI partnerships.

On September 28, 2026, OPM reported on the evolving threat landscape where AI is enabling attackers to exploit known vulnerabilities much faster than before. The agency noted that only 26% of known exploited vulnerabilities (KEVs) were fully patched, with a median patching time of 43 days, up from 32 days. OPM is leveraging AI through partnerships with Anthropic's Project Glasswing and OpenAI's Daybreak to enhance its defensive capabilities. The agency manages approximately 119 HR IT systems, complicating the patching process as each agency applies fixes on its own timeline. The 2015 breach, which compromised records of 21.5 million individuals, underscores the urgency of improving patch management. The current focus is on identifying and addressing KEVs effectively to mitigate risks. The articles emphasize the need for faster patching and better coordination among agencies to prevent exploitation.