What is Zero-day vulnerability?

A zero-day vulnerability is a security flaw that the people responsible for the software do not know about, or have not yet fixed. The name counts the days defenders have had to respond: zero. If attackers use the flaw before a fix is available, the attack is called a zero-day exploit.

How a zero-day works

Every complex program contains bugs, and some of them are security bugs. A researcher, a criminal or a government may find one first. What happens next decides how much harm follows.

A researcher who reports the flaw to the vendor starts a clock: the vendor investigates, writes a fix and ships an update. A criminal who keeps it quiet can use it for attacks that no antivirus signature or patch will stop, because nobody on the defending side knows to look. Once the vendor learns of the flaw and ships a fix, it stops being a zero-day. From then on, the risk shifts to the patch gap, the time until users install the update.

Why it matters to you

You cannot patch what does not exist yet. The practical defenses are layered: keep software updated so a flaw is closed quickly once a fix lands, limit what each program can reach, and use tools that watch for odd behavior, since there is no known signature to match. Running risky work inside an agent sandbox is one way to contain a flaw that gets through.

Zero-days are valuable. Attackers pay well for working ones, and the most dangerous kind is remote code execution, which can let someone run code on your machine from afar.

AI and zero-days

Finding bugs has traditionally been slow, specialized work. Techniques such as fuzzing automate part of it, and AI models are now being tested on finding and exploiting flaws too. Labs measure this with exercises like capture the flag challenges and track it in their safety documents. Defenders can use the same tools to find bugs first, which is why penetration testing increasingly involves AI.

An example

A researcher discovers that a document viewer can be tricked into running code when it opens a crafted file. Until the vendor learns of it and ships a fix, the flaw is a zero-day. If criminals found it first and used it in real attacks, security teams would call that a zero-day exploit in the wild.

Related terms

Zero-days are part of the wider vulnerability story, along with the patch gap, supply chain attack risk and red teaming, where defenders attack their own systems to find flaws before others do.