The United States plans to quickly eliminate critical vulnerabilities in IT systems.

Short on the news

U.S. agencies are considering sharply cutting the time required to remediate critical vulnerabilities in federal IT systems, in order to distance themselves from threats associated with powerful AI models (Anthropic Mythos, OpenAI GPT‑5.4‑Cyber).

What is actually changing?

- Traditional response window: 2–3 weeks → new plan: up to 3 days.

- The timelines are being discussed by Nick Andersen (CISA) and Sean Kearns (U.S. National Cybersecurity Director).

Why does this matter?

- Hackers have been using AI since 2023. New models can quickly discover unknown vulnerabilities and exploit them in sophisticated attacks.

- Previously, criminals needed weeks, sometimes months to develop exploits; now that interval has shrunk to a few hours.

How will it affect infrastructure?

- CISA maintains a list of “priority” vulnerabilities that are openly published and actively exploited.

- The previous remediation deadline for such flaws was three weeks; now it’s cut to two weeks, with a standard three‑day deadline under consideration.

Who cares?

- Not just government agencies.

- Business firms, especially in cybersecurity and banking, are concerned about the rapid spread of new AI models.

- Bank regulators are still assessing risks associated with these technologies.

Thus, the government aims to accelerate response to critical vulnerabilities in reaction to the growing threat from advanced AI systems.