AI Discovery: Security Researchers Identify First Agent-Found Zero-Day

In a milestone for cybersecurity, researchers have disclosed CVE-2026-21536, a critical remote code execution (RCE) flaw in a widely used web server framework. What makes this vulnerability unique is that it was discovered entirely by an autonomous AI agent during a routine fuzzing run.

The Rise of the Agentic Attack Chain

The AI agent not only identified the overflow condition but also generated a proof-of-concept (PoC) exploit that bypassed modern DEP/ASLR protections. This discovery underscores the shrinking window for human remediation, as AI-driven attackers and defenders now operate at sub-second speeds.