finding vulnerabilities is slow, skilled, human work;  a product’s exploitable flaws are knowable the day it ships;  exploitation is rare enough to notice; and  fixes keep pace with discovery. Cybersecurity AI (cai) agents, AI put to work finding and exploiting flaws in other products, falsify all four. The regime answers in two opposite ways. Against the sheer volume of flaws that agents surface it bends ( ): built for scarce attention, it re-centres compliance on defensible, documented prioritisation, and holds. But agents also collapse the speed and economics of the vulnerability lifecycle, and here it breaks (     ): a product that passed every check becomes exploitable without anyone touching it, so its market-entry test, its reporting trigger, and its one-and-done certificate vouch for a security that has quietly expired. The fault is in the landscape, not the product, so running the process more diligently cannot repair it. Anchoring every legal claim in the enacted text and every capability claim in dated results, we map each mechanism to the force that strains or snaps it, and find the cure and the disease cut from the same cloth: because defenders and attackers wield the same AI, the only conformity that survives is one that never stops running. We then carry the remedy from proposal to proof on two cra-scope robots, a humanoid and a lawn mower, where an agentic defender holds a line their undefended selves cannot. On the evidence already in hand, the cra reaches full force in December 2027 certifying products against a world that has already left the building. Static, human-paced security is finished; what replaces it must be continuous and agent-operated, and that is no longer a matter of taste.

]

1 Introduction↩︎

The European Union’s Cyber Resilience Act (cra), Regulation (EU) 2024/2847, is the first horizontal law to impose mandatory cybersecurity requirements on products with digital elements placed on the Union market [1]. It entered into force on 10 December 2024; its central vulnerability- and incident-reporting obligation (Article 14) applies from 11 September 2026, and the bulk of its substantive obligations from 11 December 2027 (Article 71). The design is deliberate, and, for the world it was drafted in, astute. Rather than demand that products be free of vulnerabilities, an outcome no non-trivial software can guarantee, the cra requires that manufacturers run a process: assess and document cybersecurity risk, handle vulnerabilities across a declared support period, ship security updates, exercise supply-chain due diligence, and report vulnerabilities under active exploitation. The regime is process-oriented, not outcome-oriented.

This paper argues that this design has already been overtaken by the vulnerability ecosystem that generative AI and Cybersecurity AI (cai) agents are now producing, and that the failure is present, not hypothetical. The point is sharp because the cra’s foundational assumptions were fixed at a specific moment: the Commission published the proposal on 15 September 2022 [2], and OpenAI released ChatGPT on 30 November 2022. The cra’s model of how vulnerabilities are discovered, predominantly by human researchers and conventional scanners, was therefore set before the capability shift its obligations must now govern, its threat assumptions notarised barely ten weeks before the technology that would void them went public. Put plainly, the cra switches on its central obligations in December 2027 calibrated to a threat model the field had already abandoned years earlier. We advance this as a European organisation working on Cybersecurity AI, and we advance it constructively: the cra is not wrong so much as early to its own obsolescence, and our purpose in diagnosing that while there is still time to act is to help Europe avert a fate that is not yet sealed.

1.0.0.1 Scope and terminology.

Two questions about AI and the cra must be kept apart. The security of AI systems treated as products, whether prompt injection or goal hijacking fits the cra’s obligations, is a real question but not ours. Our subject is the second: AI agents used as instruments of security, cai systems that discover, weaponise, and exploit vulnerabilities in other products, and how, by transforming the adversarial landscape, they invalidate the assumptions on which the cra’s process rests. Throughout, “agent” means an offensive or defensive security agent acting on the ecosystem, not an AI product being regulated. The distinction sharpens the claim: the cra can be defeated without any AI system ever being the regulated product. We also write “automated” rather than “autonomous,” because today’s leading agents operate at partial autonomy with humans in the loop [3], and the remedy we propose is a human-cai partnership, not a replacement of it.

1.0.0.2 The premises and the thesis.

A process-oriented regime does not certify that a product is secure; it certifies that a manufacturer ran a defined process. That certification is meaningful only if four background premises about the vulnerability lifecycle hold (Section 2.2):  discovery is human-scarce;  a product’s set of known exploitable vulnerabilities is knowable at market placement;  exploitation is a discrete, detectable event; and  remediation keeps pace with discovery. cai agents stress all four, and the cra responds in two opposite ways (Figure [fig:hero]). Against the sheer volume agents surface, the regime bends: is strained, and a risk-based process re-centres from “did you remediate everything?” toward “did you prioritise defensibly, and document it?” Against the collapse of the lifecycle’s tempo and economics, the regime breaks: agents withdraw     , so a conformant product becomes exploitable with no change to it, and a point-in-time certificate attests to a posture that no longer holds. The mismatch is with the landscape, not the product, so no amount of process quality restores validity. This is not a plea for patience: the capability that voids these premises is deployed, measured, and cheap today, while the obligations that ignore it do not fully bind until December 2027, so a regulator or a manufacturer that treats the agentic shift as a future contingency is already behind it. The consequence runs straight through the paper: security has to move from a periodic, human-run process to a continuous, agent-operated one, and that is precisely the move a credible cra now demands of itself.

1.0.0.3 Contributions and related work.

We reconstruct the cra’s process orientation and its four load-bearing premises from the enacted text; map each mechanism to the cai-agent dynamic that stresses it, with a verdict per provision (Table 1); state six falsifiable predictions through 2028; propose an agent-native remedy, continuous and agent-operated conformity, grounded in the same AI-security research that documents the threat; and validate that remedy on two cra-scope robots, a humanoid and a robotic lawn mower, where a cai defender (the Robot Immune System) contains attacks that fully compromise the undefended, conformant systems (Section 4). The analysis joins three literatures usually kept apart. Legal scholarship characterises the cra as hybrid, self-assessment-default governance [4] and dissects its reporting logic, contrasting the actively exploited trigger with the US known exploited construct [5], while a parallel critique argues the manufacturer-centric model fits open-source software poorly [6]. A fast-growing empirical literature documents agents discovering and exploiting vulnerabilities [7]–[11], and operational cai frameworks report large speed and cost advantages while showing the attacker edge is conditional [12]–[15]. A third strand models the vulnerability lifecycle economically, from Akerlof’s market for lemons to the disclosure-to-exploit window now measured collapsing toward zero [16]–[18]. We read the first against the second and third. To our knowledge this premise-level bends-versus-breaks decomposition, tied provision-by-provision to the enacted text, is new. Every legal claim is anchored to an article or annex of the Regulation; every capability claim to a dated primary source.

2 The Process-Oriented Regime and Its Premises↩︎

We reconstruct the cra’s process orientation from three features of the enacted text, state the four premises that orientation silently assumes, and show that the interval between assumption and obligation is exactly the interval in which the vulnerability ecosystem inverted.

2.1 A process, not an outcome↩︎

Three features make the cra process-oriented rather than outcome-oriented. First, a thin, risk-conditioned property floor. Annex I, Part I lists product properties, but the operative ones are gated on a risk assessment. Even the strongest-sounding requirement, that products be “made available on the market without known exploitable vulnerabilities” (Annex I, Part I, (2)(a)), is expressly conditioned on the Article 13(2) risk assessment. It is a floor against known exploitable flaws at market placement, not a guarantee of security, and Article 3 fixes its scope: a vulnerability can be exploited by a cyber threat (Art. 3(40)), an exploitable vulnerability one an adversary could effectively use under practical conditions (Art. 3(41)). Second, substantive obligations are handling processes. Annex I, Part II reads as a process specification: identify and document vulnerabilities, produce an sbom, “address and remediate vulnerabilities without delay,” test regularly, disclose fixed flaws, run coordinated disclosure, and distribute updates securely. Article 13 frames the duty as performing and documenting a risk assessment “updated as appropriate during a support period” and exercising due diligence over third-party components. The verbs are process verbs (assess, document, handle, disclose, update), not outcome verbs. Third, reporting is triggered by exploitation, not existence. Article 14 requires notifying only an “actively exploited vulnerability,” one for which there is reliable evidence a malicious actor has exploited it (Art. 3(42)), on a 24-hour, 72-hour, 14-day cadence through the ENISA platform. A newly discovered bug is generally not reportable. One further provision fixes scope: conformity is assessed once, against the product’s state at placing (Article 32), and re-triggered only by a “substantial modification” of the product (Art. 3). Conformity is thus a point-in-time gate on a static artefact, placing the cra much closer to continuous cyber-risk management than to a zero-defect mandate.

2.2 The four premises of the process model↩︎

The conditional promise of a process-oriented regime, run the process and the product is acceptably secure, holds only where the environment behaves as the process assumes. Four premises carry the weight of the whole edifice, and they are nowhere stated in the Regulation, which is exactly the point: they are the load-bearing walls no one thought to draw on the blueprint, the tacit model of the world the drafters inhabited.

agents weaken quantitatively (the regime bends, Section 3.1) and falsify     environmentally (the regime breaks, Section 3.2). A strained premise leaves the promise intact but harder to satisfy; a withdrawn premise voids it, because the certificate now attests to a state of the world the agent-transformed landscape no longer contains.

2.3 The assumption-formation window↩︎

The cra’s obligations bind late relative to the capability shift they must govern, and Figure 1 places the two tracks side by side. The gap is not a projection but a measurement: every point on the lower track is a published, dated result, and the most recent, cai agents compromising cra-scope consumer products, predates the Regulation’s own headline obligations. A full-text reading of the enacted Regulation confirms the blind spot. It mentions “artificial intelligence” only to cross-reference the AI Act, contains no occurrence of “machine learning,” and nowhere treats AI as a capability of the adversary. For a cybersecurity statute finalised in 2024, that is a loud silence: the adversary’s most consequential new recruit goes entirely unnamed. The point-in-time conformity it certifies is therefore blind to the one variable, adversary tooling, that the lower track is changing fastest.

The datable inflection points, restricted to agents acting as security instruments on other products, run from PentestGPT (2023, cai lineage) demonstrating LLM-guided testing (P1) [19]; through a single GPT-4 agent exploiting 87% of 15 real one-day CVEs from their descriptions, versus 0% for scanners and open models (April 2024) [7], weakening and near-eliminating the disclosure-to-weaponisation gap (P4); the open Cybersecurity AI framework ranking as the top AI team against humans in global CTFs at up to two orders of magnitude lower cost (2025) [12]; planner-plus-subagent teams reaching real zero-days [8]; Google’s Big Sleep rediscovering a latent memory-safety flaw in SQLite on demand (November 2024, P2) [9]; the DARPA AIxCC final identifying 86% of synthetic flaws and 18 real zero-days across 54 million lines of code at roughly $152 per task (August 2025) [10]; agent-emulated synthetic APTs collapsing TTP-based attribution (2026, P3) [15]; a cai agent operationalised on a production humanoid robot (Unitree G1, September 2025, P2) [20]; and an open-source agent compromising three consumer robots, finding fleet-wide flaws and showing attacks once needing deep expertise can now be run “by anyone” (March 2026) [14], which withdraws the specialised-attacker-scarcity premise (P1) for the exact product class the Regulation governs. Crucially, the same cai lineage also produced the defensive results that ground the remedy (Section 4): in controlled Attack/Defense evaluations agentic defenders out-patch attackers [13], and a self-hostable on-premise defender contains a frontier-class attacker [21]. The scarce resource in vulnerability management has moved from finding flaws to deciding which matter (the bend), while the stability of a certified posture has evaporated (the break). The next section separates the two.

3 Disarming the CRA in the AI Era↩︎

cai agents stress the cra in two ways that call for opposite responses. Volume is the quantitative face: it strains but leaves the process model’s internal logic intact, so the regime bends. The collapse of the lifecycle’s tempo and economics is the environmental face: it withdraws     , so the regime breaks. This section separates the two, maps every load-bearing mechanism to the dynamic that stresses it (Table 1), and states what each response predicts.

3.1 The regime bends: vulnerability abundance↩︎

Abundance weakens (discovery is human-scarce) without withdrawing it, and it is absorbable because the process model never assumed abundance would not occur, only that attention would be scarce, which abundance intensifies rather than negates. When security agents surface many candidate vulnerabilities, the triage queue expands: the 2026 Cloud Security Alliance synthesis frames automated exploit generation as having crossed from demonstration into operational tooling [11], and the pressure is on throughput, more candidates per unit time than any human process was provisioned for.

The honest evidence base is more sober than the headlines, and the conservative reading strengthens the argument. The widely cited 87% one-day result [7] holds only when the agent is handed the CVE description; the same study reports 7% without it. On harder real-world benchmarks, the best frameworks resolve up to 13% on cve-bench [22] and about 20% on cybergym across 1,507 vulnerabilities [23]. Yet even at that rate the same cybergym run surfaced 34 previously unknown zero-days and 18 incomplete historical patches [23], and Meta’s cyberseceval 3 already benchmarks offence as a first-class model capability [24]. Abundance does not require superhuman agents, only cheap and parallel ones: a tool that finds one real flaw in five, run continuously across a dependency graph, still overruns a human handling process.

Nothing in the cra requires zero vulnerabilities or complete remediation; Article 14’s exploitation trigger and Article 13’s risk-based framing were built for a world in which not every flaw can be chased. Faced with more candidates, the process runs against a larger input without contradicting itself, and in practice compliance re-centres from remediation-completeness toward defensible prioritisation. That prioritisation is itself getting harder to do well: on the ENISA European Vulnerability Database, the predictors it would lean on lose discriminating power, with EPSS ranking and CVSS severity decoupling from real exploitation tempo (Appendix 8). The questions an authority (Article 52) will turn on are already in the model: was exploitation actually occurring (Art. 3(42)), was the flaw reachable in the shipped configuration (Art. 13(2)), was an effective mitigation available, and was the prioritisation reasonable and documented (Annex I, Part II)? This mirrors the move mature safety engineering made long ago. The Article 14 trigger, the 24/72/14 cadence, coordinated disclosure, and the risk-based handling process all bend: strained but not contradicted. Two strains bear watching, and we treat them as predictions rather than breaks: the reporting cadence may prove too slow against machine-speed weaponisation, and coordinated disclosure weakens when a single technique generalises across a whole device family at once.

3.2 The regime breaks: landscape collapse↩︎

The second stressor is where deference to the cra’s craftsmanship has to stop. This is not a process overwhelmed with work; it is a process whose world has ceased to exist, so that a manufacturer can run it flawlessly, fund it fully, and pass every audit, and still ship a certificate that is false the week after it is signed. cai agents force this by changing the tempo, economics, and symmetry of the lifecycle, withdrawing     . When a premise is withdrawn the conformity the cra issues does not become harder to earn; it becomes invalid, attesting to a posture the landscape no longer sustains.

3.2.0.1 Certified-secure becomes trivially-exploitable, product unchanged (P2).

Annex I, Part I, (2)(a) requires placement “without known exploitable vulnerabilities.” “Known” is a point-in-time predicate presuming posture is stable shortly after placement. cai discovery falsifies it: a latent flaw unknown at assessment can be rediscovered on demand the next week at order $100 per attempt [7], [10]. The product has not changed, nor its declared conformity, yet its real exploitable set has expanded because the environment’s capacity to enumerate it has. The certificate attests to a property that is technically true and practically empty, because “known” has decoupled from “findable.” It has not lied so much as answered, with great precision, a question the world has stopped asking, and the next assessment is only another snapshot against a moving environment.

3.2.0.2 Exploitation stops being a discrete signal (P3).

Article 14 reports only actively-exploited vulnerabilities (Art. 3(42)), a design presuming exploitation is rare and detectable enough to be an informative trigger. When offensive tooling is automated and continuous [11], exploitation becomes background rather than event: “reliable evidence that a malicious actor has exploited” the flaw is either everywhere (every exposed product is probed continuously) or nowhere (agent-driven exploitation leaves a fainter human signature). Either way a duty keyed to a rare discrete event does not scale to a regime where the event is ambient.

3.2.0.3 “Remediate without delay” describes an unwinnable race (P4).

Annex I, Part II(2) is a control only if the disclosure-to-weaponisation window exceeds the update cycle. That window was already closing before agents arrived, which is why the break is structural, not speculative. Aggregating 3,549 CVE-exploit pairs across ten sources, the median time-to-exploit fell from 771 days in 2018 to 68 in 2021, 5.3 in 2023, and zero in 2025, an exponential-decay fit at \(R^2=0.98\) reaching a one-day median by 2028 [18]. Over the same span the share weaponised at or before disclosure rose from 19% to 54%, and within 24 hours from 19% to 58% (Appendix 6); peer-reviewed open-source data corroborates the direction [25], as does industry telemetry showing exploitation now often preceding patch availability [26], and Europe’s own registry reproduces it: the ENISA European Vulnerability Database shows the same collapse toward a near-zero median (Appendix 7). The same capability that let an agent weaponise a one-day CVE from its description alone [7] pushes this trend past the point where a scheduled-update model can keep pace. Against a weaponisation window now measured in hours, a scheduled patch cadence brings a calendar to a stopwatch’s fight, and running the process better does not close a gap defined by the adversary’s tempo, not the manufacturer’s diligence.

3.2.0.4 Point-in-time conformity certifies a vanishing instant (P2–P4 jointly).

These breaks share a root: Article 32 conformity is assessed once and re-triggered only by a “substantial modification” the manufacturer makes to the product (Art. 3). But the events that invalidate the attestation now originate in the environment: a new open-source offensive agent, a drop in the cost of discovery, a technique that generalises across a device family. None is a modification of any product, so none re-triggers assessment, yet each can move a whole population of conformant products from secure to exploitable overnight. The gate has no sensor for the variable that now dominates risk.

Why this is a break, not a bend↩︎

A bend leaves the conditional promise intact but costlier, and the cra’s own flexibility supplies the remedy. A break withdraws a premise, so that even a perfectly executed process issues a certificate that is false in the world the agents create. The economic stakes are clearest in the CE mark’s function. Information-security markets are a textbook case of Akerlof’s market for lemons [16]: buyers cannot observe security, so absent a credible signal the market prices every product as insecure and investment collapses [17]. The cra’s conformity regime supplies that missing signal, a legitimate and valuable goal. But a signal helps only while it correlates with quality. When agents withdraw – , the attestation is still issued on the same terms while the property it certifies evaporates, so the signal decouples from reality, and a decoupled safety signal is worse than none: it transfers risk to the buyers and integrators least able to see it while discharging the obligation on paper. A false mark carrying the authority of Union law is not a neutral failure but an active harm: it manufactures the very market-for-lemons assurance the cra was enacted to abolish, now underwritten by the state. A market-for-lemons regime is meant to drive the bad cars off the lot; decoupled, this one staples a certificate of freshness to every lemon it was built to expose. Crucially, this is independent of whether the regulated product contains any AI at all. A conventional IP camera, firmware frozen and fully conformant, is moved from secure to exploitable by an offensive agent operating around it. That is why the problem cannot be delegated to the AI Act: the object that changed is not the product but the adversary, and the cra has no mechanism that takes the adversary’s evolving capability as an input.

3.3 A mechanism-level stress map↩︎

Table 1 makes the split concrete, mapping each load-bearing cra mechanism to the cai-agent dynamic that stresses it, the premise it depends on, and a verdict, ordered from most absorbable (top) to structural break (bottom). Read as a verdict sheet the table is unflattering: the provisions that survive are the ones that merely help the process cope, while every mechanism that makes the certificate mean something, the market-entry condition, the actively-exploited trigger, and the point-in-time gate, is scored a break. The pattern is systematic: mechanisms resting only on bends, because is strained but not withdrawn; mechanisms resting on – breaks, because agents remove a feature of the landscape (stable posture, rare exploitation, a winnable remediation race) that the mechanism silently relies on. The two intermediate rows are premises mid-withdrawal, the provisions where guidance-level fixes will first prove insufficient and the leading indicators for the breaks predictions below.

5pt

5pt

3.4 Predictions↩︎

The decomposition yields falsifiable expectations about how the regime behaves as its obligations bind. Figure 2 states the dynamic schematically: agent-driven discovery throughput rises super-linearly while human triage stays roughly flat, so prioritisation partly tracks the load in the bends regime, but once agents withdraw – the gap becomes a validity deficit in the certificate that no throughput gain can close. We expect the bends predictions (1–3) to be absorbed quietly through guidance and the breaks predictions (4–6) to force a visible institutional reckoning.

The bends predictions concern recalibrating functioning mechanisms and can be met by guidance; the breaks predictions concern the certificate’s validity and cannot be met without a construct that references the environment. If they are borne out through informal stretching of existing text rather than new instruments, that is itself evidence of the structural mismatch we argue.

4 An Agent-Native Remedy↩︎

If cai agents are what break the cra, they are also, and this is the paper’s one constructive claim, the only material from which a repair can be built. The same capability that kicks the door in is the only thing quick enough to hold it shut. The move is neither optional nor incremental: stop treating the defender as a human running a periodic process, and start treating conformity itself as an agent-operated, continuously re-established property.

4.0.0.1 Why a defensive remedy is possible.

The pessimistic reading is that attackers now hold an unassailable advantage; the controlled evidence contradicts it. Across 23 Attack/Defense battlegrounds, cai defensive agents led, patching 54.3% of vulnerabilities against 28.3% offensive initial access (\(p=0.0193\)), and once defence is held to operational criteria (maintaining availability, preventing every intrusion) the gap becomes statistically insignificant (\(p>0.05\)): an equilibrium, not an attacker runaway [13]. Deployment evidence sharpens the point. LLM-driven defender agents that harden, monitor, and respond in real time cut attacker success to 0–55% with complete prevention on several configurations, and, decisively for the small manufacturers the cra also governs, a self-hostable on-premise model (alias2-mini) matched a frontier model’s defensive outcomes and detected the attacker ten times faster on a complex scenario [21]. The structural observation is that attacker and defender draw on the same capability, so defensive capability tracks offensive capability as the frontier advances. That is exactly the property needs and a human-paced process cannot supply: the remedy is not to slow the adversary but to let the defender operate at the adversary’s tempo.

4.0.0.2 From a point-in-time gate to a maintained posture.

This reframes what a certificate attests. Today the cra certifies that a manufacturer ran a process and that, at the instant of assessment, the product carried no known exploitable vulnerabilities (Annex I, Part I, (2)(a); Art. 32). The agent-native alternative certifies that a product is enrolled in a continuous defensive process: a cai agent that re-probes it against current offensive capability, re-derives its exploitable set on the cadence at which that set actually changes, and feeds remediation at machine speed. Conformity becomes a live subscription rather than a snapshot, attesting not “secure on 11 December 2027” but “under continuous, capability-current defence,” the only claim that stays true in a landscape the adversary keeps moving. Each of the three structural breaks maps onto a construct the research already prototypes: the stale-certificate break ( ) onto continuous conformity, the lost-trigger break ( ) onto agent-mediated detection and reporting, and the unwinnable-race break ( ) onto agent-speed remediation.

4.1 Recommendations↩︎

The bends/breaks split dictates the remedy. Bends are fixable inside the current text; breaks need new constructs, because a withdrawn premise cannot be restored by running the existing process better.

For the bends (guidance-level, near-term).

1. Codify prioritisation as the compliance object. ENISA guidance (Article 26) should state that, under agent-driven abundance, conformity is demonstrated by evidence-based prioritisation, reachability analysis, and documented risk acceptance, not by patch counts.

2. Recalibrate the reporting cadence. Assess whether the 24/72-hour windows (Art. 14(2)) survive machine-paced weaponisation, and whether machine-readable, partially automated reporting is needed to keep the trigger meaningful.

3. Recognise automated defensive tooling. Since the same capability defends as well as attacks [13], guidance should treat continuous, agent-assisted handling as a legitimate way to satisfy the Annex I, Part II obligations at machine tempo.

For the breaks (structural, require rule development). The unifying diagnosis is that the cra has no variable for the adversary; each construct below adds it.

1. Make conformity continuous. Supplement the Article 32 gate with a monitoring-based or periodically-revalidated component, so a certificate expresses a maintained posture rather than a snapshot.

2. Introduce an adversary-capability baseline. Assess “without known exploitable vulnerabilities” against a stated, periodically updated model of offensive capability, not only against what a manufacturer happened to know at placement.

3. Add environment-triggered re-assessment, and index support to capability. Extend the events that re-open conformity beyond “substantial modification” to material shifts in the threat environment, and tie support obligations to the adversary’s trajectory rather than to a fixed period.

4.1.0.1 Honest caveats.

Three cautions bound the claim. Autonomy is graded, not binary: current defenders operate with humans in the loop (Levels 3–4 of [3]), so “continuous conformity” means human-supervised agent operation, not unattended trust. An agentic defender is itself attack surface, importing an assurance problem the security of AI systems literature (outside our scope) must answer. And mandating continuous defence has a distributional cost, though the on-premise result above suggests a modest, self-hostable model can supply competent defence, the affordability a proportionate obligation would need. These are reasons to design the construct carefully, not reasons the point-in-time certificate can stand. Two open questions remain: whether “actively exploited” stays meaningful once exploitation is ambient, and whether a product-internal, process-oriented regime is the right instrument at all for a risk whose dominant driver is an external, fast-moving adversary capability, or whether that risk requires regulating the ecosystem rather than the product. The choice the first review faces is not between a perfect old regime and a risky new one; it is between certifying a landscape that has demonstrably vanished and building conformity that moves.

4.2 A reflection on robotics↩︎

Robots make the argument concrete and raise its stakes. A robot with digital elements is a canonical cra-scope product, but it fuses the security lifecycle with a safety one: a certificate that slips from secure to exploitable no longer merely mis-states a data risk; it licenses a physical one, a paperwork failure that can cause bodily harm, on a machine fielded for years, updated rarely, and often within the adversary’s physical reach. Each break bites harder here. On-demand rediscovery ( ) meets fleets of long-lived embedded devices that cannot be re-flashed on the cadence the landscape now moves at; the closing disclosure-to-weaponisation window ( ) meets update cycles paced by safety re-certification rather than continuous integration; and ambient exploitation ( ) erodes the already-thin line between a safety incident and a security one. This is not hypothetical: the cai agents this paper relies on have compromised consumer robots and a production humanoid, showing that attacks once demanding deep robotics-internals expertise “can now be run by anyone” [14], [20]. The agent-native remedy is, fittingly, most natural here: a defensive cai agent that continuously re-probes a robot or a fleet against current offensive capability is nearer to operational practice than to regulatory aspiration, and robotics, where product security and physical safety converge, is exactly where conformity most needs to move.

4.3 Two case studies: a humanoid and a lawn mower↩︎

The remedy is not only argued; it is demonstrated. Two cra-scope robots were evaluated with an offensive cai agent, first undefended, then enrolled in the Robot Immune System (RIS), a robotics endpoint-protection platform whose current build pairs a classical defence-in-depth stack (adaptive firewall, hardening, forensic logging) with a continuously running agentic cai defender [28]. Undefended, both robots fall exactly as the offensive literature predicts. On a Unitree G1 humanoid the agent turns a BLE command-injection flaw, opened by hardcoded AES keys shared across the entire fleet, into root, decrypts the static-key telemetry the robot beacons every 300 seconds, and reaches teleoperation [20], [27]; on a Hookii robotic lawn mower it walks 38 AI-discovered vulnerabilities into a safety-and-geofence override exposed across a fleet of 267+ devices [14]. Enrol the same robots in RIS and the same agent is contained (Figure 4, Table 2): attacker success collapses from 79% to 14% on the humanoid and from 75% to 8% on the mower, no run reaches privileged or safety-critical control, the agentic defender flags the intrusion within seconds and runs a detect–classify–block–contain loop that closes inside the attacker’s window (timed in Figure 3), and the machine keeps operating, all at sub-100-microsecond inspection latency on an on-premise, self-hostable footprint a small manufacturer can actually afford. This is the paper’s thesis rendered in hardware: the point-in-time certificate either robot could have carried says nothing about the week after it is signed, whereas a defender moving at the adversary’s tempo keeps the posture true as the landscape shifts under it. The remedy reads less as regulatory aspiration than as a running system, and it earns its keep first exactly where a stale certificate stops being a data problem and becomes a physical one.

5pt

5 Conclusion↩︎

The Cyber Resilience Act is a well-constructed instrument for the world it was written in, and its process orientation is genuinely adaptive to the first thing cai agents do: flood the vulnerability-handling process with candidates. On that axis the regime bends. The premise under strain, that discovery is human-scarce, is weakened but not withdrawn, and the cra’s own risk-based flexibility supplies the remedy, re-centring compliance on demonstrable, documented prioritisation that sensible guidance can keep standing.

The second thing cai agents do is more corrosive. By collapsing the tempo, cost, and symmetry of the vulnerability lifecycle, they withdraw the premises a point-in-time certificate depends on: that a product’s exploitable set is knowable at placement, that exploitation is a discrete detectable event, and that remediation can outrun weaponisation. When those premises go, the cra does not bend; it breaks. A perfectly executed process still issues a certificate that is false in the agent-transformed landscape, and the failure is independent of whether the regulated product contains any AI at all: a frozen, fully conformant embedded device is moved from secure to exploitable by an agent operating in the ecosystem around it. That is why the problem cannot be delegated to the AI Act, or papered over by guidance: it is a regulation certifying, at scale and with the force of law, a safety property it can no longer observe. The object that changed is not the product but the adversary, and the cra has no mechanism that takes the adversary’s evolving capability as an input.

Closing that gap requires new constructs that give the regime a variable for the adversary: continuous or capability-indexed conformity, an adversary-capability baseline, environment-triggered re-assessment. The encouraging part is that the remedy is made of the same material as the threat. Because automated defenders draw on the same capability as automated attackers, defence can track offence, and conformity can be re-cast from a snapshot into a continuously re-established, agent-operated posture (Section 4). This is no longer only a proposal: on two cra-scope robots, a humanoid and a robotic lawn mower, a cai defender already holds a line the undefended, fully conformant product cannot (Figure 4).

The timing leaves little room for hedging. The cra reaches full application in December 2027, and on the evidence already in hand the landscape it certifies against will not survive to the date its obligations bind. Even on the conservative benchmark numbers, cheap and parallel discovery is enough to withdraw the premises, because a break needs the environment to change, not the adversary to be superhuman. Europe is on course to switch on, at great cost and in good faith, a conformity machine whose certificate of health is issued for a patient the examiner can no longer see. The cra is not wrong so much as early to its own obsolescence: a last, best artefact of the pre-agentic world, certifying ghosts.

But obsolescence diagnosed in advance is a choice, not a fate. The evidence that voids the premises is already published, dated, and cheap to reproduce; only the admission lags. The demand this paper presses is therefore blunt. Security has to stop being a periodic, human-run process and become a continuous, agent-operated one, and a credible cra has to gain a variable for the adversary instead of certifying around its absence. Regulators should treat the first review not as a routine revision but as the moment to make conformity move; manufacturers should not wait for a mandate to put a defensive agent on their products, because attackers are not waiting for one to put an offensive agent there. The agentic turn in security is not a distant option to be weighed at leisure: it is the only posture that survives contact with the adversary we already have, and the case for building it, in the market and in the law, is overdue. We press this from inside the European Cybersecurity AI community and in support of the cra’s purpose, not against it: an instrument this well-built deserves to meet the threat model it will actually face, and diagnosing the mismatch now, rather than in 2027, is what keeps the outcome ours to change.

6 The Zero Day Clock time-to-exploit data↩︎

The claim that the disclosure-to-weaponisation window (premise P4) is closing is central to the breaks argument, so we reproduce the underlying data directly rather than rely on secondary reporting. Figure 5 redraws the public Zero Day Clock dataset [18] (3,549 CVE-exploit pairs from ten sources, including CISA KEV, ExploitDB, and Metasploit) in this article’s colour scheme.

6.0.0.1 Why it matters for the cra.

The regime’s remediation obligations (Annex I, Part II(2)) and support-period model (Art. 13(8)) presuppose that a manufacturer’s update cycle can outrun exploitation. A median TTE of zero means that, for the median exploited vulnerability in 2025, exploitation was observed no later than disclosure, leaving no window in which a scheduled update could pre-empt it. Panel (b) sharpens the point for the cra’s Article 14 trigger, scoped to actively exploited vulnerabilities (Art. 3(42)): when most exploited flaws are weaponised at or before disclosure, “report upon becoming aware of active exploitation” increasingly means reporting an incident that has already run its course.

6.0.0.2 Reconciling our figures with the live dashboard.

A reader comparing our redrawn US clock (Figure 7b) against the live zerodayclock.com chart will notice small differences; we reproduce the site’s published series, so the differences are worth naming. Three sources account for them. First, the 2026 cohort is partial-year and volatile: at our 1 July 2026 snapshot its trimmed-mean TTE is roughly three hours over a small sample (\(n\!\approx\!73\)), a figure that will move as the year fills in; an earlier draft plotted the site’s forward projection (about five days) here instead of the observed partial-year value, which we have corrected to match the dashboard. Second, the provenance evolves: the dashboard is recomputed as new exploit evidence lands and has shifted its own source mix over time (its current note cites CISA KEV and VulnCheck KEV with VulnCheck XDB timestamps for early cohorts, where earlier snapshots emphasised ExploitDB and Metasploit), so any static reproduction is a snapshot of a moving series and the absolute per-year values drift by a few percent between snapshots. Third, label conventions differ trivially: the site switches from months to days near the 60-day mark and reports sub-day values in hours, and we now follow the same rule (hence “53d”/“21.5d”/“3h” rather than “1.8mo”/“21d”/“5d”). None of these touches the argument: under every snapshot and both dating rules the mean falls from years to hours and crosses the one-week line by 2026. The differences are the ordinary drift of a live, continuously-recomputed dataset, not a discrepancy in the underlying trend.

6.0.0.3 A critical reading of the data.

We use this dataset because it is unusually direct, but its limits cut in both directions.

• Selection toward the fast tail. The corpus is built from vulnerabilities known to have been exploited, so it measures the TTE of the exploited subset, not of all CVEs. It speaks to how fast exploited vulnerabilities move, not to the probability that any given one is exploited, and that exploited fraction is small and, on the same data, declining (from \(\sim\)​1.5% to under 1% of all CVEs). The abundance pressure (Section 3.1) and the tempo pressure (Section 3.2) are distinct; this figure speaks only to the second.

• Timestamp noise. “Exploit availability” is dated from heterogeneous sources whose semantics differ, and the source excludes 66 records for corrupt timestamps. A median of exactly zero is partly an artefact of day-level resolution rounding same-day disclosure-and-exploit to zero. The direction and order of magnitude are robust; the precise sub-day figures are not.

• Extrapolation is not destiny. The decay fit is descriptive, not causal, and its milestone dates assume the recent slope continues. TTE cannot fall below zero, so the curve must flatten; the honest claim is that the window has already closed for the median exploited flaw, not that a specific future date is guaranteed.

• The collapse predates agents, which strengthens our thesis. Most of the decline (2018–2023) occurred before general-purpose cai agents were operational, so we do not attribute it to agents. The argument is the opposite: premise P4 was already failing on independently-measured, non-AI grounds, and agentic capability removes whatever slack remained.

Read critically, the dataset does not prove AI caused the tempo collapse; it proves the collapse is real, measurable, and already incompatible with a point-in-time, patch-cycle conformity model. That is sufficient for the breaks claim.

7 Cross-check against the European Vulnerability Database↩︎

A single data source is a weak foundation for a structural claim, so we repeat the time-to-exploit analysis on the European Union Vulnerability Database (EUVD), operated by ENISA under the NIS2 Directive and CRA. We queried the EUVD API directly [29], retrieved its full known-exploited-vulnerability dump (1,634 records), and fetched each record’s publication date, obtaining 1,632 usable pairs. For each we measured time-to-exploit as the interval from CVE publication to the date it entered the exploited-vulnerability catalogue, binned by publication-year cohort. Figure 6 overlays the result on the Zero Day Clock series from Appendix 6. (This is a separately maintained catalogue with its own dating rule but, as Appendix 8 quantifies, its exploited feed overlaps almost entirely with the US CISA catalogue, so it is best read as the same data under a more conservative dating rule.)

7.0.0.1 Do the patterns match?

Yes, on the axis that matters. For cohorts published after the catalogue existed (the uncontaminated window), the EUVD median time-to-exploit falls from roughly 200 days to single digits within three years, and the share of flaws weaponised at or before disclosure rises from near zero to 30–43%. Both movements reproduce the direction and approximate magnitude of the Zero Day Clock trend under a different dating rule.

7.0.0.2 Why the absolute numbers differ.

The EUVD medians sit above the Zero Day Clock medians for recent cohorts, and the reason is methodological. EUVD dates a vulnerability from when it was added to the catalogue, which lags the moment exploitation first occurred; the Zero Day Clock dates the first public exploit artefact. EUVD is thus a systematically conservative proxy: it over-states the window and still shows it closing to days. When the pessimistic and aggressive measures agree on the trend, the trend is robust.

7.0.0.3 A critical reading of the EUVD data.

The caveats again cut toward caution, not alarm.

• Catalogue-inception backfill. CISA KEV launched in November 2021 and EUVD in 2024, so older vulnerabilities could only be added later, mechanically inflating measured time-to-exploit for old cohorts. We shade that region in Figure 6 (a) and rest no claim on it.

• Exploited-subset selection. Like the Zero Day Clock, this corpus is conditioned on vulnerabilities known to be exploited. It measures the tempo of the exploited subset, not the probability of exploitation.

• Small annual \(n\) and coarse dating. Per-cohort counts are in the low hundreds and dates are day-resolution, so single-year wiggles are noise; only the multi-year trend is interpretable.

• Provenance overlap is near-total. The EUVD exploited feed is 99.8% sourced from CISA KEV (Appendix 8, Finding 1): only 4 of 1,632 records are unique to ENISA’s own feed. This is not an independent dataset that happens to overlap; it is nearly the same catalogue under a different dating rule. We therefore claim robustness to the dating rule, not replication by a disjoint source.

Read critically, the EUVD cross-check does not add precision; it adds robustness. The finding that survives both dating conventions and the removal of every backfill-contaminated cohort is the one the argument needs: for vulnerabilities that are exploited, the window in which a point-in-time, patch-cycle conformity model could intervene has closed to days. Premise P4 fails on EU-maintained data as surely as on the Zero Day Clock’s.

8 A European Zero Day Clock: deeper structure in the EUVD data↩︎

Appendix 7 showed that the EUVD reproduces the time-to-exploit collapse. Here we go further. Figure 7 redraws the EUVD record in the Zero Day Clock’s own visual idiom and places the original US clock directly beneath it for comparison; Figure 8 then asks whether the risk-scoring instruments a manufacturer would use to triage vulnerabilities still work.

8.0.0.1 Finding 1: two clocks, one collapse, measured under two dating rules, not from two independent datasets.

Provenance first, because it bounds the claim. Of the 1,632 exploited EUVD records here, 1,628 (99.8%) also appear in the US CISA Known Exploited Vulnerabilities catalogue; only four are unique to ENISA’s own feed. The EUVD exploited set is therefore very nearly the US catalogue re-served through an EU API, not an independently assembled European dataset, and our earlier description of it as a “wholly separate corpus” (Appendix 7) overstated the case. What genuinely differs between the two panels of Figure 7 is the dating rule (EUVD dates catalogue addition, the Zero Day Clock dates the first public exploit) and the source breadth. Those differences make the EUVD clock the slower of the two (one-day median around 2029 against 2028), so the pair brackets the collapse from a conservative and an aggressive side. The conclusion that survives is simple: under both dating rules, mean time-to-exploit has fallen from years to days and has already crossed the one-month line. A truly independent European signal will exist only once ENISA’s feed accumulates enough non-CISA entries to stand alone; it cannot yet, and we do not claim otherwise.

8.0.0.2 Finding 2: the risk-scoring instruments the cra relies on fail where they matter.

The cra’s risk-based vulnerability handling (Annex I, Part II) assumes a manufacturer can prioritise, that is, find the vulnerabilities most likely to be exploited and fix them first. That needs a working predictor. On EUVD data, the two the industry uses both fail (Figure 8b,c). EPSS, an exploitation-probability score, is not merely uninformative but inverted: the vulnerabilities it rates highest-risk are exploited later, and nearly half of the fastest-exploited flaws scored low. CVSS severity fares no better: by 2024–2026 every severity band is exploited within a 3–11-day window, so “patch the critical ones first” buys almost no time.

8.0.0.3 Why this deepens the breaks argument.

A natural defence of the risk-based model is that manufacturers need not fix everything: abundance is tolerable if they can triage. That assumes triage is possible. Finding 2 says it is not: at machine tempo the triage instruments have decoupled from the outcome they predict, so a risk-based process cannot prioritise its way out of the tempo collapse. The bends remedy (re-read the obligation as demonstrable prioritisation) and the breaks problem (the environment changed) are therefore linked: the collapse of premise P3 also removes the signal the P1 remedy would need.

8.0.0.4 Caveats.

These are cross-sectional associations on the exploited subset, and the limits from Appendices 6 and 7 carry over. In particular, EPSS and CVSS scores are read at snapshot time, so a score revised upward after exploitation would make the predictor look better than it was in advance, meaning the inversion is, if anything, understated. We therefore read Finding 2 as a robust direction (the instruments do not order tempo; EPSS is at best uninformative for the fastest attacks) and treat the exact coefficients as indicative. The modest conclusion suffices: at this tempo a manufacturer cannot know in advance which vulnerabilities will be exploited first, so a prioritise-then-patch conformity process runs without the signal it presupposes.

References↩︎