Echo has launched Frontier, a service that delivers private software patches for zero-day vulnerabilities found by advanced AI models. It is now generally available.
Frontier is aimed at organisations that need to respond to software flaws before they are publicly disclosed and before an official upstream fix is issued. The product validates each vulnerability against a working exploit, builds and tests a patch across the full application, and delivers the fix through a customer's existing JFrog or Nexus setup.
The launch comes as security researchers and software suppliers assess how large language models are changing the vulnerability cycle. Echo pointed to recent Anthropic research showing that the open-weight model GLM-5.3 produced working end-to-end exploits in 50 of 410 attempts on the ExploitBench benchmark, compared with 56 for Claude Mythos Preview.
Because GLM-5.3 is openly available, software users face the risk that unknown flaws could be found and exploited before a CVE is assigned, before scanner signatures are available, and before maintainers publish an upstream patch.
"AI models are completely rewriting the vulnerability lifecycle," said Eilon Elhadad, Co-Founder and Chief Executive Officer of Echo.
"The old assumption was that a vulnerability becomes public, gets a CVE and a fix, and then enterprises respond, but that sequence no longer holds. If AI can find vulnerabilities before the traditional security ecosystem can, remediation has to move earlier as well," Elhadad said.
Patch gap
Echo is positioning Frontier around the practical difficulty of fixing software safely once a new flaw has been identified. It cited research from 1Password's Off-by-1 Labs showing that 54% of 6,080 AI-generated patches either failed to fix the vulnerability, introduced a new one, or both.
That finding highlights a broader issue for security teams and software vendors. While AI systems may reduce the effort needed to discover bugs and generate candidate fixes, organisations still need to test whether a patch actually blocks the exploit and whether it changes application behaviour in production.
Frontier handles that process by reproducing findings against a proof of concept, identifying affected versions, developing and backporting fixes where needed, and testing the results in a cloud environment before delivery. It also provides an evidence trail covering detection and remediation for compliance purposes.
"Frontier AI can now uncover zero-day CVEs, but without the means to fix them, every discovery becomes another liability," said Eylam Milner, Co-Founder and Chief Technology Officer of Echo.
"We built Echo Frontier around the harder question: once a previously unknown vulnerability is found, how quickly can we turn it into software that is actually safe for an enterprise to run?" Milner said.
Disclosure model
The service builds on Echo's existing work in vetting, patching, rebuilding, and delivering open-source software. According to the company, the process starts with model-driven analysis and human-led security research, then moves through validation, maintainer notification, patching, testing, and private delivery.
Echo coordinates disclosure as an authorised CVE Numbering Authority and shifts customers to the official upstream fix when it becomes available. The company describes this as a shift from the traditional sequence of discover, disclose, assign a CVE, fix, and then remediate to one in which customers are protected before public disclosure.
One example involved a high-severity denial-of-service vulnerability in OpenEXR. Echo said it validated the flaw, developed and compatibility-tested a patch, and protected customers in about two days, roughly two months before an upstream fix was available.
The launch reflects a wider shift in cybersecurity from responding to public advisories to acting earlier on privately discovered weaknesses. As open and commercial AI models improve at identifying exploitable defects, software users may face growing pressure to decide how to remediate vulnerabilities that have not yet entered the normal public disclosure system.
For suppliers in the software supply chain, that creates a new commercial and operational challenge: not only finding unknown flaws, but proving that a patch can be applied safely and quickly across the versions and environments customers already use.
Frontier delivers patched software privately through customers' existing JFrog or Nexus infrastructure, then moves them to the upstream version once the official fix is released.