arXiv: After Cheap Discovery: From unknown to known-and-unfixed

The publication is a research paper, not a new regulation, but it carries significant implications for AI safety compliance. Titled After Cheap Discovery: From unknown to known-and-unfixed, it examines the gap between identifying a critical AI vulnerability and actually patching it. The paper argues that once a flaw is discovered cheaply, it enters a dangerous phase where the issue is known to researchers and potentially malicious actors, yet remains unfixed in deployed systems. This creates a window of heightened risk that current compliance frameworks do not adequately address.

The primary audience is organizations developing or deploying advanced AI systems, particularly those in high-stakes sectors like finance, healthcare, critical infrastructure, and autonomous systems. Any company subject to emerging EU AI Act obligations or internal AI safety governance should pay attention, as the paper highlights a blind spot in standard risk management: the period between discovery and remediation is often unmonitored and unregulated.

Compliance teams should treat this as a prompt to strengthen their vulnerability management lifecycle. Specifically, they should establish clear internal protocols for triaging newly discovered AI flaws, including mandatory timelines for patching or mitigating known issues. They should also document the status of any known-but-unfixed vulnerabilities in their AI risk registers, ensuring that this intermediate state is visible to senior management and, where applicable, reported to regulators. Finally, they should review their incident response plans to include scenarios where a vulnerability is publicly known but not yet remediated, ensuring they can demonstrate active oversight during that critical window.