Vulnerability remediation company Vicarius Inc. today launched an artificial intelligence engine that writes detection and remediation scripts for software flaws with no vendor patch available.

ScriptAI is aimed at the gap between a public disclosure and a working fix. Mean time to exploit stood at negative eight hours as of July on Zero Day Clock data cited this month by Radware Ltd. The same measure gave defenders 53 days in 2024.

Vicarius calls the result a capacity problem rather than a discovery one. Its announcement names Anthropic PBC’s Claude Mythos and Google LLC’s Big Sleep agent as evidence of how quickly machines now surface exploitable code. The fixes still have to be written, the company said.

ScriptAI sits inside the company’s vRx platform. When a vulnerability turns up with no vendor patch behind it, the engine drafts detection and remediation logic, and Vicarius researchers check that logic before anything runs. The platform then executes the script and verifies the result on affected machines. Vicarius said the sequence takes under an hour, against weeks for the same work done by hand.

A deterministic judge issues the pass or fail verdict, the company said, with no language model in the decision path. Each validated case ships with a cryptographically signed evidence manifest. Customers can verify it themselves. Scripts run a pre-check, apply the fix, then verify it and roll back on failure, so a breaking change is caught before it reaches production.

“Finding ten times more vulnerabilities is meaningless if remediation still happens through tickets, manual research and weeks of engineering work,” said Roi Cohen, co-founder and chief executive of Vicarius. “If AI can find the vulnerability, AI should help build the protection.”

Vicarius has done a version of this before. The vuln_GPT model arrived in August 2023, billed as the first trained specifically to write remediation scripts, and its output went out free through the company’s vsociety community. The verification step is what ScriptAI adds.

Everything the engine writes lands in the vScript library under a ScriptAI label. The scripts run as native Bash and PowerShell at the operating system level, with no additional agents or proprietary rule formats.

ScriptAI becomes the fourth path in what Vicarius calls True Remediation. Patching runs through vPatch. When no patch is available, vShield protects the workload, and vScript holds custom and community-sourced remediation scripts.

The new service is available to vRx customers starting today. Vicarius has built remediation tooling out of New York and Tel Aviv since 2016, and Bright Pixel Capital led a $30 million Series B round for the company in January 2024.

Image: Vicarius/GPT Image 2.5