The Minute-Zero Threat.

How AI Agents Are Rewriting the Rules of Cyber Attacks

AUTHOR

Christian Have

Chief Technology Officer

BIO

Christian leads product, engineering, architecture, quality, and AI and data at Helm. He has more than 20 years of experience in security across law enforcement, healthcare and global enterprise, including work with the Danish National Police, and was previously CTO and Chief Product Officer at LogPoint. He holds a degree in information security from the IT University of Copenhagen, has completed executive programmes at MIT, and advises and speaks at international security forums including Europol, Interpol and NATO.

READ

2 MIN.

PUBLISHED

29.10.2026

There is no zero-day anymore. Only a minute zero.

There is no such thing as a zero-day threat anymore. There is only a minute zero. In this on-demand ransomware webinar, Christian Have, Chief Technology Officer at Helm, explains how attackers now organise, adapt and strike faster than any human can respond, and what it takes to stay in control when attacks no longer wait.

Why minute zero?

In July, roughly 1,200 of OpenAI’s AI agents organised themselves into a coordinated operation that breached Hugging Face’s production infrastructure, rebuilding their coordination within hours every time human responders shut it down.

Mandiant put the average gap between a vulnerability being disclosed and exploited at 32 days across 2021 and 2022, and five days in 2023. For 2025 that average is minus seven days, meaning attacks now routinely arrive before the flaw is public. Most security programmes were built for a threat that no longer exists.

What the session covers.

In this session, Christian Have discusses:

Why the zero-day model is dead, and what the OpenAI and Hugging Face breach revealed about attackers that now organise, adapt, and strike faster than any human can respond.
Why chasing faster detection is a fight worth losing on purpose, and exactly where that assumption breaks down in your patching, triage, and incident response programmes today.
What it takes to stay in control when attacks no longer wait, and where cybersecurity is headed next.

The case behind the session.

The OpenAI and Hugging Face incident sits at the centre of the session. Around 1,200 agents exchanged more than 70,000 messages and files through a shared repository, chained a handful of textbook vulnerabilities into a real breach, and were back inside and coordinating again within hours after responders rebuilt the system.

None of the individual exploits was new. What was new was the speed and the organisation around them. Chaining many small flaws into a real attack has become cheap, and attacks that once took hours now run in seconds. Read the full analysis in our article on the incident.

What defenders can control.

Likelihood × impact = risk. Likelihood is rising, as attack tools spread to cheaper, more open models and the cost of an attempt falls, and defenders can do little about it. Impact is the part you control, from how far an attacker gets and how much one stolen credential unlocks to how fast you recover.

That is where Helm works. When an attack gets in, Helm contains it at the speed of the attack and gives you the evidence to recover safely and prove what happened.