Echo launches Frontier to patch AI-found zero-days

Echo has launched Echo Frontier, a product designed to turn zero-day vulnerabilities found by advanced AI models into private software patches before public disclosure.

The launch comes as security researchers report that newer open-weight AI models are becoming more effective at finding and exploiting software flaws. Anthropic research cited by Echo found that Zhipu AI's GLM-5.3 produced working end-to-end exploits in 50 of 410 attempts on the ExploitBench benchmark, compared with 56 for Claude Mythos Preview.

That matters because GLM-5.3 is openly available, while more tightly controlled systems are not. The shift raises the prospect that vulnerabilities could be discovered and exploited before a CVE is assigned, detection signatures are created or maintainers issue an upstream fix.

Echo said the new service addresses remediation rather than vulnerability discovery alone. Each finding is validated against a working exploit, then fixed and tested across the full application before the patch is delivered to customers through existing JFrog or Nexus repositories.

Customers then move to an official upstream fix once one becomes available, Echo said. The company also provides documentation on the detection and remediation process for compliance purposes.

"AI models are completely rewriting the vulnerability lifecycle," said Eilon Elhadad, Co-Founder and Chief Executive Officer of Echo.

"The old assumption was that a vulnerability becomes public, gets a CVE and a fix, and then enterprises respond, but that sequence no longer holds. If AI can find vulnerabilities before the traditional security ecosystem can, remediation has to move earlier as well," Elhadad said.

Patch gap

The announcement points to a growing gap between the ability to find vulnerabilities and the ability to fix them safely. Echo cited research from 1Password's Off-by-1 Labs, which found that 54% of 6,080 AI-generated patches either failed to fix the vulnerability, introduced a new vulnerability or did both.

That reflects one of the central concerns around AI-assisted software security. A model may identify a bug or generate a code change quickly, but the resulting patch can still break application behaviour or leave the underlying issue unresolved.

Echo said Frontier is intended to reduce that risk by combining automated analysis with validation and compatibility testing before any code is deployed. The process includes discovering unknown vulnerabilities, reproducing them with a proof of concept, identifying affected versions, notifying maintainers, developing and backporting fixes where needed, and distributing patched software privately.

Echo also said it coordinates disclosure as an authorised CVE Numbering Authority. That gives it a role not only in creating temporary protections for customers, but also in the formal disclosure process that follows.

"Frontier AI can now uncover zero-day CVEs, but without the means to fix them, every discovery becomes another liability," said Eylam Milner, Co-Founder and Chief Technology Officer of Echo.

"We built Echo Frontier around the harder question: once a previously unknown vulnerability is found, how quickly can we turn it into software that is actually safe for an enterprise to run?" Milner said.

OpenEXR case

Echo said it has already used the approach in a recent case involving OpenEXR, the open-source image file format library. It discovered a high-severity denial-of-service vulnerability, validated the flaw and developed a patch that protected customers in about two days.

According to Echo, that protection was in place roughly two months before an upstream fix became available. The example illustrates the company's argument that organisations may need an intermediate layer of remediation when AI-driven discovery moves faster than the standard vulnerability management cycle.

Echo framed the process as a departure from the conventional model of discover, disclose, assign a CVE, fix and then deploy updates in enterprise systems. In its version, discovery is followed by validation, fixing and customer protection before broader disclosure and eventual convergence with the upstream patch.

Echo said the service is generally available. The offering builds on its existing work vetting, patching, rebuilding and delivering open-source software used across enterprise systems, including containers, libraries, operating system packages and virtual machines.