The cybersecurity concerns of AI agents recently hit a crescendo as OpenAI, Anthropic, and other frontier providers elaborated how their systems managed to escape their testing environments to hack other computer systems. The software security implications are dire, and this clearly doesn’t bode well for our collective cyber-safety as bad actors gain these capabilities. But there’s a more pernicious type of hacking that I want to write about today: Legal Zero-Days.
In cybersecurity a “Zero-Day” is a security flaw, unknown to the developer, that when exposed leaves them zero days to fix it before it’s exploited. In their new paper in AI Ethics, Sadler and Sherburn explore the notion of a Legal Zero-Day (2026). The idea is that agents might be able to find vulnerabilities in a society’s legal system that they could exploit in order to facilitate legally dubious and potentially harmful actions that the legal system is not able to reign in through litigation or legislation before impact. It’s bad enough that frontier agents can now hack computer systems, but what if they did it in a way that was immune from legal action against it?
The authors first examine the formal requirements of a Legal Zero-Day, before going on to measure the capabilities of frontier models for finding them using an expert-informed benchmark. They consider five defining characteristics of a Legal Zero-Day: (1) that it is a genuinely novel discovery about the law, (2) that is has immediate effects before any litigation or legal processes could occur, (3) that it doesn’t stem internally from the legal system such as through an executive action, (4) that is can cause significant societal impacts, and (5) that it is time-consuming to rectify and can’t just be waived away through administrative rule-making. In sum, these are new exploits with immediate impacts that can’t be easily rectified.
To create a benchmark to evaluate model performance in finding Legal Zero-Days, the authors worked with legal experts to develop legal puzzles. These puzzles take existing law and introduce a tweak that might go unnoticed but which can be exploited. For instance, shifting the scope of a definition in a law just a little bit might drastically change who is subject to enforcement or make it easy for actors to side-step the underlying intent of the law. Legal experts created nine of these puzzles for the benchmark covering instances from Australia, the UK, India, and Brazil. Each puzzle describes an original law or legal framework, a modified version of it which introduces the vulnerability, and an explanation of the legal logic of how the modification creates issues.
They then tested six models (a frontier model and a smaller version each from OpenAI, Anthropic, and Google) on their ability to find the loophole in each legal puzzle. The legal experts graded 25 responses to create a ground truth and then a prompt was developed that aligned with the legal expert opinion so that the evaluation could be automated. Important to add that they were testing just the model here, not tools or access to the internet. The results show that no model achieved more than 10% detection of exploits introduced in the puzzles. Four of the puzzles were entirely unsolved, while the other five had detection rates spanning 3% to 30%.
The results show that, while there is some evidence that models can find some legal exploits, there is a considerable capability gap in their ability to do so reliably and for a wide variety of puzzles. Still, I find the implications here worth paying attention to, especially since these models were tested without access to tools or search. I assume any model would do much much better at this task if they could access any number of legal interpretations or critiques available on the internet.
Even with limited capability, now that we know this is a possibility, governments should be scanning LLMs over their current legal code as well as any new legislation drafted to identify potential exploits that can be remedied. Our research on using LLMs to simulate policy in light of various changes suggests that such methods can identify policy options that help mitigate risk (Barnett et al, 2024; Barnett et al, 2026), but the method could just as well be flipped around to simulate which policy changes introduce new risks, such as Legal Zero-Days. We need to start making our systems more robust now before agent capability improves.
References
Barnett J, Kieslich K, Helberger N, et al. (2026) Informing AI Policy Assessment using Large-Scale Simulation of Interventions. Proceedings of the 2026 ACM Conference on Fairness, Accountability, and Transparency: 3942–3978.
Barnett J, Kieslich K and Diakopoulos N (2024) Simulating Policy Impacts: Developing a Generative Scenario Writing Method to Evaluate the Perceived Effects of Regulation. In: Proc. AI, Ethics, and Society, 2024.
Sadler G and Sherburn N (2026) Legal Zero-Days: a novel risk vector for advanced AI systems. AI and Ethics 6(3): 330.