What is a zero-day? Explained with a faulty door lock

Today's news about OpenAI's GPT-6 Cyber says that in outside testing, the model's successful attacks included zero-day vulnerabilities. So here is what a zero-day actually is.

In one sentence: A zero-day is a weakness in software or hardware that the people who make it don't yet know about or haven't fixed, so there is no fix you can install when someone first uses it to break in.

The everyday picture

Think of the lock on your office's back door. You bought it from a well-known lock maker. It looks solid, and you lock it every night.

But this model of lock has a hidden weakness. Turn the key slot a certain way and it opens without a key. Nobody knows yet, not even the lock maker. Every building with this lock has the same weak spot.

Now imagine a burglar works out the trick first. The lock maker has had zero days to make a better part, because it doesn't know there is a problem. That is a zero-day. The usual explanation of the name is exactly this: the maker has had zero days to fix it.

How it works, step by step

1. A flaw sits in the software (the hidden weakness in the lock). Programs are huge and written by people, so mistakes slip in. Most stay unnoticed for a long time.
2. Someone discovers it. If an attacker (the burglar) finds it first and uses it, that is a zero-day attack. The US National Institute of Standards and Technology (NIST) defines it as an attack using a previously unknown hardware, firmware or software weakness.
3. Or a defender finds it first. A security researcher (a locksmith who tests locks to make them safer) spots the trick and quietly tells the vendor (the lock maker), so it can be fixed before the details go public.
4. The vendor ships a patch (a replacement part for the lock). A patch is an update that closes the weakness.
5. You install the patch (fit the new part on your door). Until you do, your building is still open to the trick, even though the fix exists.

Where the picture stops

• A burglar has to visit each building in person. An online attacker can try the same trick on thousands of systems at once, from anywhere.
• Changing a lock part takes an afternoon. Patching software is usually just an update, but in a busy business it can take longer, because updates need testing so they don't break other things.
• You can see a lock. Most people never see the code inside their apps, so they rely on the vendor to tell them a fix is ready.

Why it matters for your business

• Speed of updates is protection. The UK's National Cyber Security Centre (NCSC) and its allies warned in 2024 that most of the 15 flaws attackers exploited most often in 2023 were first exploited as zero-days. Their advice: install security updates promptly.
• Bugs may be found faster. AI tools that help hunt for flaws, like the one in today's news, can help both defenders and, eventually, attackers. Waiting weeks to update gets riskier.
• Know what you run. You can only patch software you know you have. A simple list of your systems and suppliers makes updates quicker.
• Plan for the gap. A zero-day has no fix at first, so backups and limited access reduce the damage if one is used against you.

An example

Imagine a 20-person accounting firm. One Monday, the maker of its file-sharing system announces an urgent fix for a flaw attackers are already using. The firm has a list of its systems, so it knows within minutes that it is affected. It follows the vendor's advice, installs the update that afternoon, and checks its logs for signs of a break-in. A firm without that list might not notice the warning for weeks.

Frequently asked questions

Why is it called a zero-day?

The common explanation is that the maker has had zero days to fix the flaw, because it has only just learned about it, or hasn't yet.

Can antivirus stop a zero-day?

Not reliably. Many security tools look for known threats, and a zero-day is new by definition. Layers like limited access, monitoring and backups help reduce the harm.

Does a zero-day stay a zero-day forever?

No. Once the vendor releases a patch, it becomes a known vulnerability. It is still dangerous for anyone who hasn't installed the update.

What should a small business do about zero-days?

Turn on automatic updates where you can, install urgent security fixes quickly, keep a list of the software you use, and keep backups you have tested.

Related explainers

• What are backups? Explained with a spare key at a friend's house
• What is an AI agent? Explained with an assistant you send on errands
• What is an LLM? Explained with a new hire who read the whole library

Sources

• NIST Computer Security Resource Center: zero day attack (glossary)
• NCSC: Vulnerability management, understanding vulnerabilities
• NCSC: UK and allies warn about shift in cyber attackers exploiting zero-day vulnerabilities
• OpenAI Deployment Safety Hub: GPT-6 Cyber System Card