Stuxnet and state-sponsored zero-day stockpiling (2010)
The Stuxnet worm, widely attributed to U.S. and Israeli intelligence, used four previously unknown zero-day vulnerabilities to sabotage Iran's nuclear centrifuges. It was the first confirmed case of a cyberweapon causing physical damage to infrastructure, and it revealed that nation-states had been quietly stockpiling zero-day exploits rather than disclosing them to vendors.
Iran's uranium enrichment program was set back by an estimated two years. The worm escaped its target and spread globally, exposing the technique to the world.
Governments formalized vulnerability stockpiling through programs like the U.S. Vulnerabilities Equities Process, which weighs offensive intelligence value against defensive disclosure. The tension between hoarding exploits and patching them became a permanent feature of cybersecurity policy.
Project Glasswing faces the same fundamental tension: Anthropic has a tool that can find vulnerabilities at unprecedented scale, but controlling who gets access and ensuring findings go to defenders rather than attackers reprises the stockpile-vs-disclose debate at AI speed.