Frontier AI models identify software flaws, weaponize them, and move through a network faster than defenders have ever faced before, Zscaler security experts told Expert Insights at Black Hat 2026.
Zscaler has a unique vantage point into the potential risks of frontier models. The company was among the first 40 organizations granted restricted access to Anthropic’s most capable model, Mythos, through Project Glasswing, and it holds similar access to OpenAI’s GPT-5.5 cyber model.
They ran their own unique harnesses on frontier models, which revealed capabilities far beyond what is being commonly reported of frontier model capabilities.
“It’s not hype,” Chief Security Officer Deepen Desai told Expert Insights. “These models are a step function increase in their ability to do multi-step reasoning across a variety of cyber capabilities.”
“It’s Not Hype”
One finding stood out in Zscaler’s evaluations. When Zscaler ran frontier models against its own code, the models did not just find bugs, they started writing working exploits almost immediately.
Then the models would then generate a patch to fix the issue, but when the team applied that patch and ran the model again, the result was unexpected.
“Three out of five times, [the model] was able to bypass its own patch,” Desai says. The researchers had to run the patch cycle two or three times before the patch actually stopped agents being able to circumvent it.
As this scenario starts playing out in the real world, teams will need to rapidly change how they think about software vulnerabilities. “You need to leverage these powerful models to find the issues and fix them before the attackers leverage these same powerful frontier models to find the issues and exploit them.” Desai says. “That’s the game you are in. You can no longer be reactive.”
All vulnerabilities represent real risk
Zscaler’s second finding was that AI agents are extremely effective at chaining low-level vulnerabilities into critical attack paths. “Seeing it in action, and the ability to do it in minutes versus days, was very, very interesting,” Desai saysaid. His team observed the behavior in Mythos and GPT-5.5 and is now seeing open weight models improve at the same task.
That has direct consequences for how organizations prioritize fixing software flaws. A vulnerability scored as low severity and thought of previously as low priority, can now become the first link in a critical chain.
“Low severity issues can become critical if that asset is easily reachable and exploitable,” Desai says. This becomes an even greater challenge when considering the supply chain angle.
“What keeps me and most CXOs up at night is your third-party supply chain,” Desai says. Attackers can now use frontier models to scan open-source libraries, find flaws, and target every internet-facing application that depends on them. Recent malicious NPM and PyPI packages are early signs of what is coming.
When Zscaler began testing frontier models, it assumed the restricted frontier models were three to six months ahead of what would become generally available. Asked whether that assessment still holds, Desai pointed to the rapid progress of open weight models such as Kimi K3, Qwen, and GLM 5.2. “It’s very close,” he says.
The Agent Identity Crisis
This is a compounding problem. Zscaler found frontier models are extremely capable at discovering an organization’s exposed AI surfaces, like ungoverned chatbots, agents, and model endpoints that business units are deploying at speed.
This means that as organizations rush to deploy new AI tools, they are creating an even larger attack surface, making it even easier for new frontier models to exploit and find pathways into the network.
“Agent identities are sprawling and connecting to more and more things, which is creating a crisis situation in enterprises where they don’t know what identities have access to what,” Dhawal Sharma, Zscaler’s EVP for AI Security and Strategic Initiatives explains.
“Agents have too many permissions,” he argues. An agent spun up for a single task frequently inherits the full authorization of the human who created it and can spawn sub-agents that do the same.
The end result is not that AI is inventing a new category of risk. Rather, it is accelerating the exploitation of the risks most organizations already carry, and collapsing the time they have to respond.
Zero Trust, Rebuilt For Agents
When it comes to securing these challenges, Desai’s first answer is visibility and concealment. Hide the attack surface so it cannot be scanned and fingerprinted. But they must also assume compromise anyway and segment aggressively so that a foothold on one machine or one agent leads nowhere.
“If you do a true zero trust implementation, the path that the attackers are able to take from these compromised assets or agents shrinks,” he tells Expert Insights.
Zscaler’s solution to these challenges is a zero-trust platform built specifically for the era of agentic AI.
First, the platform has to see and steer an agent’s traffic wherever it originates, whether on an endpoint, in the public cloud, or between SaaS applications.
Second, the platform integrates with the emerging identity layer for agents, from Entra ID and Okta’s agent identity services to protocols like SPIFFE and SPIRE and consumes enterprise agent registries so that policy can follow an agent wherever its traffic appears.
Third, it builds a context layer around each agent. This is where the AI Access Graph comes in, built on Zscaler’s recent acquisition of Symmetry Systems. Zscaler constructs a bottom-up graph of how data, identities, AI applications, and agents connect across the enterprise. The graph ties an agent’s behavior to the risk of the data and identities it touches, the human it is attached to, and even its token and cost footprint.
Finally, the platform enforces intent-based policies, applied inline at the gateway and on the endpoint across every agentic and MCP traffic flow. “This whole layer needs to be built ground up to have identity awareness, context awareness, and being able to insert yourself in all agentic and MCP traffic flows,” Sharma said.
This solves one of the biggest challenges when it comes to applying zero trust to AI agents: context. Gateways without context have no idea what risk is attached to an agent’s traffic. Zscaler’s access graph ties an agent’s behavior to the riskiness of the data and identities it touches, so policies can be enforced with that critical information attached.
The endpoint layer also goes somewhere traditional endpoint security does not. Rather than watching the operating system and file system, Zscaler instruments the agentic applications themselves, and inserts hooks into tools like Claude, Codex, and Cursor to analyze the skill files agents load and the tasks they perform.
Zscaler has also added virtual patching to its Zero Trust Private Access solution to address the shrinking vulnerability exploit window. “Assume that there will be vulnerabilities you won’t be able to patch,” Sharma says. “If you use zero trust architecture the right way, those vulnerabilities will not be exposed to the internet.”
Finally, Zscaler’s platform also includes deception technology designed to trap malicious agentic AI systems and frustrate their progress when trying to break into a network. In Zscaler’s own red team exercises with frontier models, dynamic decoys were the single control that performed best.
For Sharma, pulling those pieces into a single platform is what matters most. “The piece I’m most excited about is how you bring these use cases through a single platform, so customers can consume them as a holistic service versus buying six or eight products.”
Fix The Basics, At Speed
Desai offers a six-point playbook for CXOs to get ahead of frontier AI model challenges including that covers the expanding attack surface &, to proactive capabilities to get ahead of AI risk.
- Reduce and hide the external attack surface.
- Implement zero- trust segmentation properly, for agents as well as humans.
- Get visibility and governance over every AI asset.
- Unify vulnerability management with AI-driven exposure management.
- Run continuous, AI-driven red teaming rather than point-in-time tests.
- Rebuild security operations for machine-speed response.
But while technical capabilities will be clearly fundamental to getting ahead of AI challenges, Desai’s final piece of advice for security teams is to simply move quicker.
“We all know what needs to be done. Unfortunately, the time has already run out in many of those situations, because the attackers are leveraging this [technology] and you just don’t know about it,” he says.
“Don’t wait for a two- or three-year roadmap. Things like deception, get it done in the next two months. That’s a quick win.”
