AI-driven vulnerability discovery is no longer restricted to proprietary frontier models — smaller open-source models are already finding the same zero-days, so CISOs should assume that attackers will gain access within months.