AI-Driven Zero-Day Vulnerabilities: A Dual Threat Landscape

Severity: High (Score: 69.5)

Sources: Letsdatascience, eqs-cockpit.com

Summary

Since mid-2025, the cybersecurity landscape has seen a surge in zero-day vulnerabilities, with TrendAI™'s ÆSIR platform discovering 21 critical CVEs across major platforms like NVIDIA, Tencent, and MLflow. Concurrently, threat actors, notably the BRONZE BUTLER group, have automated the discovery and exploitation of zero-day vulnerabilities, significantly reducing exploit timelines from months to minutes. The automation tools employed include large language models that facilitate reconnaissance and exploit code generation. This dual trend of proactive vulnerability discovery by security firms and reactive exploitation by attackers highlights a widening gap in the cybersecurity defense landscape. Key vulnerabilities include CVE-2025-33183 and CVE-2025-33184, both published on November 18, 2025, and CVE-2025-23296, published on August 13, 2025. The rapid pace of AI development and exploitation poses significant challenges for organizations striving to maintain robust security postures. The current status indicates an urgent need for enhanced detection and patch orchestration capabilities to mitigate these threats. Key Points: • TrendAI™'s ÆSIR platform discovered 21 critical CVEs since mid-2025. • Threat actors are automating zero-day discovery, reducing exploit times to minutes. • Key vulnerabilities include CVE-2025-33183, CVE-2025-33184, and CVE-2025-23296.

Key Entities

• Bronze Butler (apt_group)
• Zero-day Exploit (attack_type)
• MLflow (company)
• Nvidia (company)
• Tencent (platform)
• Cuda-x Libraries (platform)
• Motex Lanscope Endpoint Manager (platform)
• Nvidia Isaac Gr00t Architecture (platform)
• Secure_server (platform)
• CVE-2025-23296 (cve)
• CVE-2025-33183 (cve)
• CVE-2025-33184 (cve)
• CWE-287 - Improper Authentication (cwe)
• Cwe-502 - Deserialization Of Untrusted Data (cwe)
• T1203 - Exploitation for Client Execution (mitre_attack)
• Fenrir (tool)
• Mimir (tool)
• Secure_server Authentication Bypass Vulnerability (vulnerability)
• TorchSerializer Deserialization Vulnerability (vulnerability)