How Oligo Catches Zero-Days From Frontier Models

TL;DR

• A customer used a limited access AI model to find an unreported vulnerability in their own application and build a working exploit for it.
• They ran the exploit against an environment protected by Oligo’s runtime sensor to see if it would be caught.
• Oligo detected and blocked the malicious activity at runtime, while enabling the rest of the application to continue running normally.

A few weeks ago, one of our customers ran a controlled test. They have access to a frontier AI model that reads code and finds novel ways to break it. They pointed it at one of their own applications, let it develop a working exploit for an undisclosed vulnerability, and then ran that exploit against a system where Oligo was deployed.

The intention of the test was simple: can Oligo detect an exploit attempt of a zero-day vulnerability?

It did. Here’s the walkthrough of what the flaw was and how Oligo catches exploit attempts tied to unknown vulnerabilities. 

The Flaw

The vulnerability was a code injection issue. In the application, untrusted input - data from an HTTP request - reached a language primitive it was never meant to see directly: a function that took input and acted on it, without validation or sanitization in front of it. 

From there, the primitive did what it was built to do with whatever it was handed, and what it was handed led out of the application to a network connection the app was never meant to initiate, opened from inside ordinary application logic. What started as a malformed request ended as unauthorized data access and, ultimately, arbitrary code execution.

Nothing about the primitive was malicious. It was doing exactly what the language built it to do. The problem was what reached it, and what happened next.

How Oligo detects malicious behavior

This is the heart of how exploitation works for any vulnerability. Applications run on framework and language primitives: functions that parse input, evaluate expressions, open connections, read files. Under normal use, these primitives do ordinary work. 

An exploit is what happens when untrusted input drives one of them outside its designed use.

Consider a single function that evaluates an expression. Fed a validated numeric value, it calculates a result and returns, operating as it’s designed. Fed a raw request body, the same function forks into a different path: it evaluates attacker-controlled input, opens a socket, and makes a network connection the application was never built to make.

‍

As you can see, the primitive and code path are the same up until the fork, leading to vastly different results.

Oligo watches for exactly that fork. By observing code execution and operating system activity together in real time, Oligo sees when a primitive is driven somewhere it was never designed to go: input evaluated that should never be evaluated, a connection opened that should never open, and a process taking an action the application never takes.

That is why the vulnerability being unknown did not matter. Oligo does not need to recognize the flaw itself because it provides the deep context to recognize the abuse of the primitive. And primitive abuse is the common thread through every exploit, whether it’s a decade old CVE or something a frontier model found earlier today.

Why this is the model that holds

Vulnerability management runs on the assumption that you know what you’re defending against. A zero-day breaks that assumption by definition as there’s nothing to scan for and nothing to even patch.

That gap used to buy defenders time, because finding a novel, working exploit was slow and expensive research work. But when a frontier model can find a novel flaw and produce a working exploit faster than any human research team, the gap between "a flaw exists" and "a flaw is being used" collapses toward zero.

FS-ISAC has made the same point in its Sector Risk Advisory on AI-enabled vulnerability discovery: as the window between discovery and exploitation keeps shrinking, the traditional risk-management cadence no longer keeps up. Its guidance now tells firms to stop exploits while they are in progress, using runtime application protection and other controls that actively intervene rather than only watching.

ADR that is Battle Tested

Oligo is now battle-tested against zero-days discovered by frontier AI, but our product detecting exploitation at runtime really just proves that it works as intended under real-world conditions.

What the test actually probed was much more narrow: whether that detection depends on having seen something like the flaw before. This vulnerability had no database entry, no threat advisory, and a few weeks earlier hadn't even been generated yet.

Detection held up because our technology observes behavior. It was keyed in on the fork – a trusted primitive pushed outside its designed use, caught the moment it happened. Every exploit produces a fork somewhere.

As AI shortens the gap between a flaw existing and a flaw being used, that's the property worth building defenses around.