AI Exploit Foundries: a Zero-Day Assembly Line Aimed at Your Appliances

For most of the last decade, a working zero-day in a network security appliance was an expensive, artisanal thing: weeks of one specialist reversing firmware, a scarce output guarded like ammunition. On 10 September 2026 Anthropic published a threat-intelligence report that documents the end of that economics. One of its case studies describes a China-nexus operation running an automated exploit foundry — a scheduled, unattended pipeline of AI agents that decompile appliance firmware, hypothesize vulnerabilities, and validate exploits around the clock. In a single month, one workflow produced more than a dozen candidate zero-days across roughly 50 targeted organizations.

The word that matters is foundry: not one clever exploit, but a production line. This article is about what changes when zero-day discovery against the devices at your perimeter becomes an industrial process — and why the only defensive answer that keeps pace is one that runs the same class of engine on your side of the wire.

What an AI exploit foundry actually is

Anthropic tracks the operation as GTG-10007. The mechanics, from the report: the actors "configured autonomous AI-driven workflows to target appliance firmware and binaries," loading images into decompilers and dispatching assistant agents to survey them, build cross-reference chains "over thousands of decompile calls," form vulnerability hypotheses, and test exploit code against lab copies of the same appliances. Thirteen standing collection agents ran on a scheduled job with no operator present.

Read that again as an operations engineer would. This is not a person using an AI to go faster. It is a system: parallel workstreams with shared tooling and persistent campaign records, running on cron, that treat vulnerability research the way a CI pipeline treats a build. The output over one month — more than twelve candidate zero-days against ~50 organizations, with working exploits for several network and security appliance families — is a throughput number, not a heroic one-off.

That reframes two assumptions defenders still lean on:

• "Zero-days are rare, so patch cadence is enough." When discovery is industrialized against a fixed catalogue of appliances, the mean time between your appliance model getting a fresh, unpublished bug and someone using it drops toward the length of a scheduled job.
• "Nation-state capability is a small club." Anthropic's blunter finding is that agentic frameworks have collapsed the labor and tooling gap: one operator with the right harness now approximates the output of a resourced state team. The barrier that kept this class of attack scarce was human hours. That barrier is gone.

Why security appliances are the raw material

An exploit foundry needs a target class that is (a) internet-facing, (b) homogeneous enough that one bug pays off across many victims, and (c) opaque to the defender. Security appliances score maximum on all three. A firewall, VPN concentrator, email gateway, or sandbox sits at the trust boundary by design, runs a closed firmware image the customer cannot instrument, and frequently cannot host an EDR agent — the very "agentless" property that makes it a device is what makes its compromise invisible.

This is not theoretical, and it is not only in Anthropic's report. Look at what CISA has been forced to add to the Known Exploited Vulnerabilities catalog in the same weeks:

Appliance	CVE	Class	Status
SonicWall SMA1000	CVE-2026-83549	OS command injection	KEV, exploited
SonicWall SMA1000	CVE-2026-83548	Server-side request forgery	KEV, exploited
N-able N-central	CVE-2026-86218	Static code injection	KEV, exploited

Each of these is exactly the profile a foundry optimizes for: an edge device, mass-deployed, that most owners treat as an appliance they installed once and stopped watching. We wrote earlier about FortiSandbox as the security appliance nobody watches — the point generalizes. The GreyNoise operator behind the PaperCut campaign below had, per their telemetry, been probing internet-facing systems from Palo Alto, Ubiquiti, Citrix, SonicWall and Proxmox since early July. The reconnaissance surface is the appliance fleet.

From foundry to mass exploitation in one hop

A foundry only matters because its output feeds a delivery engine of the same nature. GreyNoise's account of the PaperCut NG/MF campaign, published 9 September 2026, is the clearest public look at the second half of the pipeline. A single operator built a private lab with a vulnerable PaperCut server and an Active Directory domain, developed exploits for CVE-2026-81578 (auth bypass) and CVE-2026-82078 (unsafe-reflection RCE) — the pre-auth chain we covered when it first landed as a zero-day in the print server — then handed the validated chain to hundreds of autonomous agents powered by an OpenAI Codex harness and a DeepSeek model.

The result is a throughput profile no human team produces:

• 440+ PaperCut instances compromised, across 395 organizations in 48 countries.
• Eleven organizations compromised in a 26-second window.
• Initial access to domain admin in as little as 5 minutes; a high school went from first access to domain admin in 7.

"It found the bug on a schedule, and it used the bug on a schedule. There was no window between disclosure and exploitation, because for the victims there was no disclosure — the first public artifact was the compromise."

That is the operational thesis in one line. The foundry removes the discovery bottleneck; the swarm removes the delivery bottleneck. What used to be a chain of human decisions — find, weaponize, target, exploit, escalate — is now one continuous automated flow, and the slowest step is measured in minutes.

The economics changed, not just the speed

It is tempting to file this under "attacks got faster." The deeper shift is cost. Google's threat intelligence group had already documented the first zero-day in the wild believed to be AI-developed — a semantic 2FA-bypass in a widely used web administration tool, its exploit script betraying its origin with textbook docstrings and a hallucinated CVSS score. That was a proof of concept for can it. Anthropic's foundry is the proof of at what rate and what price.

When the marginal cost of the next candidate zero-day approaches the cost of an API call and a scheduler entry, three defender habits stop working at once: annual penetration tests (they sample a moving target once a year), CVSS-driven patch triage (it ranks disclosed bugs, and the foundry's output is undisclosed by construction), and "we're too small to be targeted" (the swarm does not choose targets one at a time; it sweeps a class). The correct planning assumption is now that a reachable, unpublished bug in one of your edge appliances exists and is findable by a machine — and your job is to find and close it before the machine on the other side does.

Remediation

You cannot patch a bug that has not been disclosed. So the appliance-defense posture that survives an exploit-foundry threat model is about exposure and evidence, not just patching. Treat this as a standing runbook for every internet-facing security/network appliance you own.

1. Am I exposed? Enumerate every appliance management and data-plane interface reachable from the internet. From outside your perimeter: nmap -Pn -p- --open <edge-range> and confirm no appliance admin UI, API, or SSL-VPN portal answers where it should not. The winning move is deletion: an interface that is not reachable cannot be in a foundry's target set.
2. Patch on the vendor's clock, not yours. Apply fixed versions the day they ship for anything on the KEV list — the live examples above (SonicWall SMA1000, N-able N-central) already carry federal deadlines. Subscribe to each vendor's PSIRT feed; a foundry-era patch SLA is hours, not the next maintenance window.
3. Can't patch now? Shrink the blast radius. Bind management planes to a jump host or VPN-only segment, enforce allow-listed source IPs on admin interfaces, and disable unused services on the appliance. Every removed feature is a removed decompile target.
4. Hunt for compromise — the appliance won't tell you. Because these devices are agentless, the honest evidence is off the box. Diff appliance-reported logs against an independent copy shipped to your SIEM at write time; a gap is tamper (MITRE ATT&CK T1070 indicator removal). Watch the wire for the tells an owned appliance can't hide: an interactive shell or beacon egressing from a device that historically only receives connections, DNS or TLS to never-seen ASNs, and lateral fan-out from the appliance into the management VLAN (T1190 exploit public-facing app → T1041 exfiltration).
5. Eradicate by rebuild, verify after. Root-level appliance compromise means the firmware is untrusted; factory-reset or re-image from a known-good signed image rather than cleaning in place, rotate every credential and API token the appliance held, then re-confirm the egress baseline is quiet after the rebuild.

Where this leaves Zero Hunt

The uncomfortable symmetry of GTG-10007 is that the winning defense has the same shape as the attack: an autonomous, multi-agent engine that continuously proves what is reachable on your own perimeter. That is precisely what Zero Hunt's 10-agent AI swarm — Recon, Exploit, Web, Credential, Post-Exploit, Pivot, Tactic and Report under an AI Controller — is built to do. Its change-triggered campaigns fire a full assessment within the hour a new appliance appears on the perimeter, and the Exploit and Web agents write a per-target exploit chain with a local LLM rather than replaying a public PoC — the same generative approach the foundry uses, pointed at your surface to answer the one question CVSS cannot: is this device actually reachable and exploitable here, before someone's scheduled job decides it is. Every skill is backtested in the AI Gym against Vulhub and the 314-CVE black-box corpus before it touches production, and every finding is ECDSA-signed for a defensible audit trail.

The deployment model is the part the Anthropic report makes non-negotiable. The adversaries in that report weaponized commercial frontier models — Claude, an OpenAI Codex harness, a DeepSeek model — as their exploit engine. Handing your own firmware and attack surface to a cloud model to "test" it means shipping the exact raw material a foundry wants to the exact class of system being abused to build one. Zero Hunt runs 100% on-prem: a local offensive model, no cloud callbacks, no external LLM APIs, air-gap supported. The engine that reverses your appliances never leaves your network — which is the only place the analysis of your attack surface should ever run. And when a foundry-fed swarm does reach the delivery stage, the AI Traffic Analysis model reads the mass-exploitation behaviour on the wire — the interactive shell, the never-seen-ASN beacon, the lateral fan-out — while it is happening, on a surface the compromised appliance cannot edit.

The exploit foundry is not coming; per two threat-intel teams it is already running on a schedule. The question a security leader should be asking this quarter is not "are we patched," but "who reaches our appliances' reachable bugs first — and does our side of that race run on the same clock." Talk to us about running the assessment engine that does.