Echo has launched Echo Frontier, a service designed to help organizations address vulnerabilities identified by frontier AI models before public disclosure. The offering combines vulnerability discovery with validated, compatibility-tested fixes and delivery through customers’ existing software infrastructure.
Frontier AI models are accelerating vulnerability discovery and exploitation, and access to these capabilities is extending beyond tightly controlled environments. In research published Sept. 29, Anthropic reported that Zhipu AI’s open-weight GLM-5.3 produced working end-to-end exploits in 50 of 410 attempts on the ExploitBench benchmark, compared with 56 for Claude Mythos Preview. Unlike Mythos Preview, GLM-5.3 is available for anyone to use.
AI-driven vulnerability
Anthropic described its release as "a meaningful step change in the cyber capabilities available to attackers." Unknown flaws may now be found and exploited before a CVE, scanner detection or upstream patch is available, adding pressure to already stretched security teams.
The issue also carries business implications. When an organization learns that a previously unknown vulnerability may be exploitable, it needs a dependable way to respond, even if the traditional disclosure and patching process has not begun.
“AI models are completely rewriting the vulnerability lifecycle,” said Eilon Elhadad, co-founder and CEO of Echo. “The old assumption was that a vulnerability becomes public, gets a CVE and a fix, and then enterprises respond, but that sequence no longer holds. If AI can find vulnerabilities before the traditional security ecosystem is able to, remediation has to move earlier as well.”
Validated fixes and compliance evidence
Finding a vulnerability is only part of the challenge; developing a reliable fix is another
Finding a vulnerability is only part of the challenge; developing a reliable fix is another. Research by 1Password’s Off-by-1 Labs found that 54% of 6,080 AI-generated patches either did not fix the vulnerability, introduced a new one, or did both.
“Frontier AI can now uncover zero-day CVEs, but without the means to fix them, every discovery becomes another liability,” said Eylam Milner, co-founder and CTO of Echo. “We built Echo Frontier around the harder question: once a previously unknown vulnerability is found, how quickly can we turn it into software that is actually safe for an enterprise to run?”
Echo says Frontier’s fixes are tested against the exploit and compatibility-tested across the application in a cloud environment before delivery. The process is intended to help organizations deploy patches without disrupting application behavior. Customers also receive documentation of detection and remediation to support compliance requirements.
Open-source vulnerability response process
Echo reports that it recently found a high-severity denial-of-service vulnerability in OpenEXR. The company validated the flaw, developed and compatibility-tested a patch, and protected customers in about two days—roughly two months before an upstream fix became available.
Echo Frontier builds on the company’s existing systems for assessing, patching, rebuilding and delivering open-source software. Its process includes:
- Discover: Search for unknown vulnerabilities using model-driven analysis and human-led security research.
- Validate: Reproduce findings with a working proof of concept and identify affected versions.
- Notify: Alert maintainers and coordinate disclosure as an authorized CVE Numbering Authority (CNA).
- Patch and test: Develop fixes, backporting them where needed, and check that they address the vulnerability without disrupting application behavior.
- Deliver: Provide patched software privately through customers’ existing JFrog or Nexus infrastructure.
- Converge: Move customers to the official upstream fix when it becomes available.
Echo contrasts this approach with the conventional sequence of discovery, disclosure, CVE assignment, fixing and enterprise remediation. Frontier’s process moves from discovery to validation, fixing and protection before disclosure, then transitions customers to the upstream fix.
