Historical intelligence backfill. This assessment covers reporting originally published on 2026-08-06 and was added to the RWP archive on 2026-09-07.
Nozomi's "zero-days at AI speed" is a disclosure-capacity warning — not a new ICS 0-day dump
6 August 2026 — Labs says their own AI-assisted finding cut operational hours per vulnerability about 60 percent vs 2025. The bottleneck moved to vendor PSIRT, not to a named plant incident.
Bottom line up front
CONFIRMED Nozomi, 6 August 2026 — a methods/policy note, not a CVE list. Claim: AI made their vulnerability discovery faster; the constraint moved to validation, write-up, and vendor disclosure. They report roughly 60 percent fewer operational hours per vulnerability across those stages vs 2025. Pair with Team82's June Zenitel/Claude experiment and Forescout's September WAGO porting exercise (human-steered, a bricked PLC). This post does not name a 2026 ICS zero-day used in the wild. Process impact: none. Tempo risk for unpatched OT firmware: ASSESSED.
Historical backfill of 6 August 2026 reporting; added 7 September 2026.
What happened
A vendor research-ops blog. Useful as a clock-speed argument. Easy to over-read as "AI is popping PLCs unattended."
Why it mattered
ICS patch cycles are measured in maintenance windows. If finding gets cheaper and PSIRT does not, the unpatched year gets longer relative to the attacker.
Who / what was affected
No named victims. Every owner still running last year's firmware.
Technical context
Do not wait for an AI-written Industroyer. Do inventory, segment, and compensating controls — the same SANS five.
Exploitation / threat status at the time
CONFIRMED Nozomi's internal hours claim as they state it.
UNKNOWN adversary time-to-exploit compression on OT specifically.
What defenders should have done
- Assume more ICS CVEs per quarter, not better patches.
- Risk-based "Now/Next/Never" (Dragos YIR language) instead of CVSS-only.
- Read this next to Hands-Free, not instead of AA26-097A.
RWP assessment
Confidence: Medium on the 60 percent figure (vendor self-report). High that this is not an incident report.
Defensive actions
- PSIRT intake that can handle volume.
- Compensating controls when the OEM is slow.
- Do not fund "AI 0-day" theater over internet-facing PLC removal.
Sources
- Nozomi Networks — Zero-days at AI speed
- Claroty Team82 — Hands-free LLM vulnerability research
- Forescout — AI-assisted PLC exploit porting still needs humans