Key Takeaways
- OpenAI’s Codex autonomously rooted a Samsung TV by chaining an entire exploit (enumeration, code analysis, hypothesis testing, PoC, execution) in minutes—tasks that typically take human researchers weeks.
- Claude Mythos (Anthropic), AISLE, and ÆSIR (Trend Micro) have uncovered thousands of critical vulnerabilities in Windows/macOS/Linux/browsers and dozens of CVEs in NVIDIA/Tencent/MLflow, proving AI can find zero-days at industrial scale.
- The real challenge isn’t whether AI can find vulnerabilities—it’s the asymmetric speed gap: AI scans and exploits 24/7, while manufacturers patch at human speed, widening the cybersecurity divide.
A Samsung TV Rooted in Minutes: The Codex Example
In 2026, OpenAI’s Codex successfully gained full root access to a Samsung TV running KantS2, a software platform from 2018–2020. The process was fully autonomous:
- Attack surface enumeration.
- Firmware source code analysis.
- Live hypothesis testing on the device.
- Proof of Concept (PoC) development in seconds.
- Exploit execution to achieve root privileges.
What’s alarming? Codex only needed basic shell access and the firmware’s source code. For context, a human team would take weeks to complete these steps. Worse, the exploited flaw—a driver left with write permissions on the firmware—is a common vulnerability in embedded systems.
Samsung has since patched the flaw, but the incident raises a critical question: How many outdated or poorly maintained devices remain exposed?
AI as a Zero-Day Factory: A Paradigm Shift
Codex isn’t alone. Other AI models, such as:
- Claude Mythos (Anthropic): Identified thousands of critical vulnerabilities in Windows, macOS, Linux, and major browsers.
- AISLE: Discovered 12 critical vulnerabilities in OpenSSL, patched in January 2026.
- ÆSIR (Trend Micro): Claims 21 CVEs in targets like NVIDIA, Tencent, and MLflow since mid-2025.
The verdict is clear: AI automates vulnerability discovery at an unprecedented scale and speed. It scans continuously, without fatigue, and with surgical precision.
The Asymmetric Challenge: AI vs. Human Teams
The core issue isn’t whether AI can find vulnerabilities—we already know it can. It’s the speed at which it does so.
- Attackers (AI-powered): Can scan firmware 24/7, test millions of combinations, and exploit flaws in hours.
- Defenders (human teams): Patch at human speed—reading reports, testing, validating, deploying—delayed further by vacations, commercial priorities, or outdated devices.
Result: A growing time gap, where attackers (human or AI) gain a structural advantage over defenders.
What Can Users Do?
The Samsung flaw was fixed… if users installed the update. But for a five-year-old TV used sporadically, the odds are slim.
Essential reflexes:
- Check for updates on all connected devices (routers, IP cameras, smart home gadgets, old phones, etc.).
- Disable unused devices—an unpatched device is a potential entry point.
- Isolate critical devices (e.g., security cameras) on a dedicated network.
- Audit your environment regularly—a basic vulnerability scan can reveal known flaws.
Toward Post-Human Cybersecurity?
The Samsung TV example is just a preview. If an AI can root a TV with basic shell access, what other devices are vulnerable? Smart routers, connected cars, medical implants, industrial systems… the list is long.
