Palo Alto Networks on August 19, 2026 launched the Frontier AI Critical Defense Program, a coordination effort that pairs AI labs, software makers and operational technology vendors to shield critical infrastructure from vulnerabilities that AI models are now finding faster than operators can patch. New participants include Anthropic, OpenAI, OT vendors Mitsubishi Electric and Axis Communications, healthcare and financial risk-sharing groups Health-ISAC and the Analysis and Resilience Center for Systemic Risk, the energy research nonprofit EPRI, and Akrites, a Linux Foundation initiative.
The program rests on a mismatch the company has been documenting in its own research. Two weeks earlier, its Unit 42 division disclosed that an autonomous discovery system it built, called NOVA, had found 14,090 confirmed vulnerabilities across 3,915 open-source projects in a two-month run, 99.4% of them previously unreported. Nearly 40% scored high or critical severity. Operators of power grids, factory floors and hospital equipment, bound by uptime requirements and safety validation, cannot deploy software fixes at anything close to that pace.
The program’s answer is virtual patching: network-level protections, deployed through Palo Alto Networks’ Advanced Threat Prevention service on its firewalls and SASE products, that block exploit traffic before it reaches a vulnerable system. The goal is to buy time between a vulnerability’s discovery and the day a tested patch can safely go into production.
“In the age of Frontier AI, the traditional, reactive race to build and deploy software patches before adversaries exploit a flaw is a losing battle,” said Lee Klarich, the company’s chief product officer, in the announcement. “Protecting critical infrastructure requires a structural shift from isolated patching to collective, proactive intelligence.”
How the Coordination Works
The program page describes three pillars. Collaborators exchange sensitive vulnerability information inside what the company calls a secure, embargoed network. Palo Alto Networks then converts that intelligence, along with findings from its own AI-driven research, into network-level protections it describes as “air cover” while customers work through their patch cycles. In return, participating vendors receive anonymized telemetry on in-the-wild exploitation attempts against their products, a feedback loop meant to show them how their code is being targeted.
One design detail matters given who is at the table: the company says its Frontier Virtual Patching system safeguards sensitive vulnerability details from attackers while pushing protections out, an obvious concern when the same frontier models being enrolled as defenders are also the engines making mass vulnerability discovery cheap.
The Program Builds on Months of Prior Deals
The August 19 expansion extends a structure Palo Alto Networks has been assembling through 2026. On June 24, 2026, it announced that IBM and Red Hat would fold the company’s virtual patching into Project Lightwell, their $5 billion open-source security commitment, under a “shield-and-fix” workflow where network protections go up the same day a flaw is found while remediation proceeds upstream. Microsoft participates through MAPP, its longstanding active protections program, and the company already runs OT threat research with Siemens and Idaho National Laboratory.
The direction of travel is consistent across the industry. Anthropic has been recruiting security firms into its Glasswing vulnerability-hunting initiative, which Horizon3.ai joined in July 2026, and OpenAI has been expanding its Daybreak cyber defense models, most recently onto Amazon Bedrock. The FBI has separately warned that it expects adversaries to point frontier AI at software bugs, the same scenario Unit 42’s NOVA results demonstrate is already technically feasible.
The Exposure Gap, by the Numbers
- 14,090 confirmed vulnerabilities found by NOVA in two months, 99.4% of them previously unreported
- 3,915 open-source projects scanned across six language ecosystems
- 39.7% of findings rated high or critical severity under CVSS 4.0
- 55 days: the industry-average time to deploy a traditional patch, which the company says its virtual patching collapses to a “near-zero window of exposure”
- 5,421 supply-chain findings, including 2,776 downstream exposures validated with working proof-of-concept exploits
Whether the program changes the defender’s math depends on adoption by the vendors whose products sit inside critical environments. The participation of the two leading frontier AI labs is notable on its own: both are now supplying defensive capability to a security vendor at the same time their models drive the discovery surge that makes the program necessary. Palo Alto Networks is taking collaborator applications through the program page, and says protections are already being delivered to joint customers.
