28 Zero-Days in Two Days: AI-Speed Security Discovery Reaches Robotics

AI Summary

Security firm VicOne has reported finding 28 zero-day vulnerabilities in less than two days using AI-assisted research, targeting the software and tools that support the Physical AI ecosystem — the robots, autonomous machines, and industrial automation systems now spreading through factories worldwide. A zero-day is a software flaw the vendor does not yet know about, meaning no patch exists. The finding matters less for the number 28 and more for the speed: security discovery has become machine-fast, on both the defender's side and the attacker's. For Malaysian manufacturers adopting robots and automation under Industry4WRD, this means robot software must now be managed like any other IT asset — inventoried, patched, and contractually governed.

Key Takeaways

• VicOne found an initial set of 28 zero-day flaws in under 48 hours using AI-assisted research across software and tools supporting Physical AI — work that traditionally takes expert teams weeks or months per bug.
• The target was the toolchain around robots, not single machines. A flaw in shared build or support software can be inherited by every product built with it — one bug, many victims.
• Discovery speed is dual-use. The same AI methods are available to attackers, shrinking the window between "unknown flaw" and "actively exploited flaw."
• Malaysian factories buying robots through integrators rarely ask about software update policies. That procurement gap is now a real business risk.
• The word "initial" matters: these findings still need vendor validation, disclosure, and patches. AI finds candidates fast; humans still confirm and fix.

What Happened

VicOne, a cybersecurity firm, announced that it identified an initial set of 28 zero-day vulnerabilities in less than two days. The research used AI-assisted methods and covered software and tools supporting what the industry calls the Physical AI ecosystem — the layer of software that lets AI systems act in the real world, whether that is a robot arm on a production line, an autonomous mobile robot moving goods in a warehouse, or the development and management tools used to build and run those machines.

To understand why 28 in two days is unusual, you need to know what a zero-day is. A zero-day vulnerability is a flaw in software that the vendor has had "zero days" to fix — they did not know it existed until a researcher told them. Finding one used to require a skilled human researcher spending days or weeks reading code, probing inputs, and testing edge cases. Some zero-days are found after months of effort. Some are never found at all.

AI-assisted research changes that arithmetic. Instead of a human reading every code path, an AI system can scan, correlate, and hypothesise at machine speed, flagging suspicious patterns for human researchers to verify. Twenty-eight candidate zero-days in under 48 hours is the output of that method working at scale.

Two honest caveats. First, the source report does not name the specific software or tools affected — standard practice, since naming them before patches exist would hand attackers a map. Second, the word "initial" signals that validation and responsible disclosure with the affected vendors is likely still in progress. These are real findings from a credible security firm, but they are the beginning of a process, not the end.

Why It Matters

The story here is not the number. It is the clock.

Think of traditional security research as a locksmith inspecting one door at a time, by hand. AI-assisted research is a locksmith who can inspect every door on the street simultaneously. When discovery becomes that cheap and fast, three things change.

First, the volume of disclosed vulnerabilities in robotics will rise sharply. Robot and automation vendors — many of them hardware companies with young software teams — will have their patch pipelines stress-tested in a way they never have before. A vendor that takes six months to patch a reported flaw cannot survive a world where AI finds dozens of flaws per week across the industry.

Second, physical AI raises the stakes of each bug. A vulnerability in a banking app leaks data. A vulnerability in a robot control stack, fleet management system, or motion-planning tool can stop a production line, damage equipment, or injure a worker standing next to a cobot. Software flaws cross into the physical world. That is why this news sits in robotics rather than ordinary enterprise IT.

Third, and most important: this capability is not exclusive to defenders. Attackers have access to the same AI models and the same methods. The practical consequence is that the "unknown flaw" window — the period when a bug exists but nobody is exploiting it — is collapsing. If you operate robots, you can no longer assume obscurity or slow attacker discovery protects you. Assume flaws will be found fast, exploited fast, and patched only if you are paying attention.

There is a supply-chain logic here too. VicOne researched the software and tools supporting the ecosystem — the plumbing. A flaw in a shared component spreads silently into every machine and deployment built on top of it,