独家：消息人士称，美国官员考虑缩短漏洞修复期限以应对人工智能驱动的黑客攻击

Exclusive: US officials weigh cutting deadlines to fix digital flaws amid worries over AI-powered hacking, sources say

2026-05-01 17:04:05 UTC / Reuters

Exclusive: US officials weigh cutting deadlines to fix digital flaws amid worries over AI-powered hacking, sources say

By Raphael Satter

May 1, 2026 5:04 PM UTC Updated 2 hours ago

节点运行失败

AI (Artificial Intelligence) letters are placed on computer motherboard in this illustration taken, June 23, 2023. REUTERS/Dado Ruvic/Illustration/File Photo Purchase Licensing Rights, opens new tab

• Summary

• CISA proposal would cut government bug fixing deadlines from 3 weeks to 3 days, sources say
• Suggestion comes as AI models like Anthropic’s Mythos boost hackers’ ability to exploit flaws
• Experts caution that moves to tighten deadlines may run up against ​resource and readiness issues

WASHINGTON, May 1 (Reuters) – U.S. cybersecurity officials are considering sharply shorter deadlines for fixing critical flaws in government IT systems, ‌amid concerns hackers could exploit them using artificial‑intelligence tools such as Anthropic’s Mythos, people familiar with the matter said.

The move, which has not been previously reported, would slash the deadline for responding to actively exploited vulnerabilities from an average of two or three weeks to three days, the people said.

Jumpstart your morning with the latest legal news delivered straight to your inbox from The Daily Docket newsletter. Sign up here.

Advertisement · Scroll to continue

Anxiety over the power and proliferation of AI models like Mythos and OpenAI’s GPT‑5.4‑Cyber has ​been building for weeks. Although hackers have been deploying AI since at least 2023, these newer models are said to be able to easily identify previously ​unknown vulnerabilities or seize on freshly disclosed ones to enable complex hacking operations. So while it previously might have taken hackers ⁠several months, weeks, or days to take advantage of software flaws, that timeframe has been compressed, in at least some cases, to a matter of hours.

That in turn ​is putting pressure on defenders to kick into high gear, said Stephen Boyer, the founder of cybersecurity company Bitsight, which has previously helped CISA catalogue vulnerabilities.

Advertisement · Scroll to continue

“If you’re going ​to protect civil agencies, you’re going to have to move faster,” Boyer said. “We don’t have as much of a window as we used to have.”

The two sources familiar with the matter said the deadline proposals were being discussed by Nick Andersen, the acting chief of the Cybersecurity and Infrastructure Security Agency, and Sean Cairncross, the U.S. national cyber director. Reuters could not establish whether ​a final decision on the matter has been made or when one could be expected. CISA and the Office of the National Cyber Director did not immediately offer ​comment.

CISA has for years curated a catalogue of known-and-exploited vulnerabilities, or KEVs, which are seen as priorities because they are out in the open and actively being abused by criminals or ‌spies. CISA ⁠has typically given civilian agencies a three-week deadline to fix such flaws once they are added to the database, according to cybersecurity researcher Glenn Thorpe, although that has recently dropped to around two weeks. Deadlines are occasionally compressed to deal with particularly serious problems, but the new proposal would see the default cut down to just three days, the sources said.

The discussions at CISA come as business leaders and the digital security industry grapple with the fallout from the release of more advanced AI models. The banking ​industry, in particular, has been sent scrambling as ​regulators race to get a handle ⁠on how dangerous the new technology is.

Tightening deadlines at CISA will likely serve as a model for state and local governments as well as businesses and other groups, said Nitin Natarajan, who served as the deputy director of CISA under former President ​Joe Biden.

“This is a signal to others that says, ‘Hey you need to do this more quickly,’” he said.

Natarajan, who now ​runs the cyber consultancy ⁠NN Global, said speeding up the deadlines made sense given how quickly AI-powered threats were evolving. But he warned that CISA – which has been depleted by deep job cuts and buffeted by government shutdowns under President Donald Trump – needed the capacity to handle the strain of tighter deadlines.

“We’ve seen a reduction in their resources, both in funding and expertise,” Natarajan said.

Kecia ⁠Hoyt, a ​vice president at the threat intelligence firm Flashpoint, warned that patching software flaws could be a complicated ​process involving detailed tests ahead of deployment. “Realistically, three days is simply impossible for some environments,” she said.

John Hammond, the senior principal security researcher at Maryland-based Huntress, said dropping deadlines to three days would be “quite ​a change.” While he said he was cautiously optimistic about running things faster, “only time will tell how well the industry keeps up.”

Reporting by Raphael Satter; Editing by Chizu Nomiyama

Our Standards: The Thomson Reuters Trust Principles., opens new tab