Legal Zero-Days: Hidden Governance Vulnerabilities

• Legal Zero-Days are previously undiscovered flaws in legal frameworks that trigger immediate and significant governance disruptions.
• They draw an analogy to software zero-days by highlighting latent vulnerabilities in statutes, constitutional provisions, and regulations.
• Empirical benchmarks reveal that current AI models struggle to detect these vulnerabilities, emphasizing the need for advanced legal assessment tools.

Searching arXiv for the cited paper ids to ground the response in current arXiv metadata. Legal Zero-Days are previously undiscovered vulnerabilities in legal frameworks that, when exploited, can cause immediate and significant societal disruption without requiring litigation or other processes before impact (Sadler et al., 12 Aug 2025). The concept deliberately analogizes legal infrastructure to technical systems that contain latent flaws discoverable before defenders can respond, while emphasizing that the analogy is imperfect because legal vulnerabilities arise from the structure and interaction of statutes, constitutional provisions, regulations, and administrative procedures rather than from mechanistic code defects (Sadler et al., 12 Aug 2025). In the current literature, the term denotes a specific AI-relevant risk category: the possibility that advanced systems may eventually discover hidden legal interactions that bypass safeguards, disable oversight, or impede government response, even though present frontier models remain weak on benchmarked versions of this task (Sadler et al., 12 Aug 2025).

1. Definition and conceptual boundaries

The most precise definition in the literature is given through five criteria. A Legal Zero-Day must be: a novel discovery about how a law functions, or how multiple laws interact; immediate in effect, meaning its ramifications impact real-world systems without requiring subsequent litigation, lengthy legal processes, or discretionary action before consequences begin; external in origin, rather than created by the legal system itself; significantly disruptive; and time-consuming to rectify, lasting weeks or months and resisting simple administrative or discretionary correction (Sadler et al., 12 Aug 2025).

These criteria distinguish Legal Zero-Days from several adjacent concepts. They are not identical to ordinary legal ambiguity, because the concept requires a latent flaw or interaction whose discovery has concrete disruptive consequences rather than merely interpretive uncertainty (Sadler et al., 12 Aug 2025). They are not the same as desuetude, the pacing problem, or routine legal evolution through ordinary interpretation (Sadler et al., 12 Aug 2025). They also differ from standard regulatory arbitrage: arbitrage typically exploits known rule structures or jurisdictional differences for commercial gain, whereas a Legal Zero-Day requires a previously undiscovered vulnerability and substantial disruption (Sadler et al., 12 Aug 2025). Nor are they equivalent to illegal conduct; the concern is precisely that the disruptive consequence may arise from the law as written or structured (Sadler et al., 12 Aug 2025).

The zero-day analogy is central but bounded. Cybersecurity zero-days involve latent vulnerabilities, discovery before defense, and asymmetric advantage to the discoverer. Legal Zero-Days share those features, but they are harder to patch because remediation may require legislation, constitutional amendment, by-elections, administrative reconstruction, or judicial clarification rather than a software update (Sadler et al., 12 Aug 2025). This suggests that the term denotes not merely a metaphor, but an attempt to treat legal and constitutional infrastructure as a load-bearing system with its own failure modes.

2. Structural properties and neighboring zero-day concepts

The concept sits within a broader family of zero-day and vulnerability research, but it addresses a different object of analysis. In software security, zero-days may be accidentally introduced bugs or deliberately inserted malicious code that persist for years because ordinary revision does not reliably expose them (Lohn, 2018). In smart-contract research, zero-day attacks may exploit not only coding defects but socially engineered, deployment-conditional vulnerabilities that survive testing and activate in production (Ivanov et al., 2022). Legal Zero-Days extend the zero-day frame to institutional governance: the vulnerability lies in legal interaction, the exploit lies in discovery and use of that interaction, and the impact is governance disruption rather than code execution (Sadler et al., 12 Aug 2025).

A useful distinction in the literature is between latent defects and actionable artifacts. In software-security economics, bugonomics is defined as “the operational economics of producing, proving, prioritizing, and fixing security-relevant defects,” with the unit of analysis being artifacts defenders can act on: candidate reports, validated findings, proofs of impact, remediation packages, and accepted fixes (Pesoli et al., 23 May 2026). For Legal Zero-Days, a plausible implication is that governance should care not only about the abstract existence of a legal vulnerability, but also about the artifact chain by which it is recognized, explained, escalated, and remediated. That implication is interpretive, but it follows closely from the contrast between abstract vulnerability and operationalized defender response in the zero-day literature (Pesoli et al., 23 May 2026).

The same comparison clarifies what Legal Zero-Days are not. They are not legal-domain zero-shot reasoning tasks of the sort studied in statute-based entailment benchmarks. Work on “legal zero-shot” prompting shows that law is a domain in which generic prompting is fragile and lawyer-like reasoning scaffolds such as IRAC can materially improve performance on legal entailment tasks (Yu et al., 2022). That literature concerns model performance on legal reasoning benchmarks; it does not define Legal Zero-Days as a risk concept. The proximity of terminology is superficial rather than substantive.

3. Risk model and mechanisms of disruption

The literature presents a conceptual rather than mathematical risk model. There is no formal threat equation, payoff model, or stage-based exploit-chain formalization in the paper introducing Legal Zero-Days (Sadler et al., 12 Aug 2025). Instead, the risk model is grounded in the five defining criteria and in the claim that some legal vulnerabilities have pre-adjudicative effects: institutions may suspend actions, reverse appointments, halt enforcement, question legitimacy, or enter a period of legal uncertainty severe enough to impair normal operation before courts or legislatures stabilize the situation (Sadler et al., 12 Aug 2025).

The mechanism of harm is therefore less about courtroom victory than about immediate institutional consequences. According to the paper, discovered legal vulnerabilities could bypass safeguards by invalidating or narrowing the scope of regulations, disable oversight by paralyzing agencies through administrative or constitutional chaos, obstruct incident response by consuming governmental bandwidth or undermining legal authority, and destabilize governance by threatening parliamentary majorities, appointments, enforcement authority, or the legal basis of policy (Sadler et al., 12 Aug 2025). The authors place this capability alongside established dangerous capability areas such as cyber offense, CBRN, misinformation, and autonomous power-seeking, while arguing that canonical risk taxonomies may miss this institutional attack surface (Sadler et al., 12 Aug 2025).

This framing is significant because it shifts focus from direct physical or cyber harm to institutional fragility. A sufficiently capable AI might parse large legal corpora, track complex dependencies across statutes and jurisdictions, identify load-bearing provisions, and notice consequences that human experts have overlooked (Sadler et al., 12 Aug 2025). If such a system could discover multiple Legal Zero-Days, the paper argues that it might accumulate them as strategic resources for bypassing safeguards or impairing state response during critical incidents (Sadler et al., 12 Aug 2025). The present evidence does not show that current systems can do this reliably, but it establishes the category of concern.

Criterion	Meaning in the literature
Novel discovery	Previously undiscovered legal interaction or function
Immediate effect	Real-world impact without prior litigation or lengthy process
External origin	Discovery from outside ordinary legal change
Significant disruption	Meaningful impairment of governance or societal function
Slow rectification	Weeks or months to resolve; not simply corrected

4. Methodology: legal puzzles as evaluation instruments

Because it would be ethically problematic to ask AI systems to find real unknown vulnerabilities in live legal frameworks, the paper proposes expert-crafted “legal puzzles” as controlled evaluation instruments (Sadler et al., 12 Aug 2025). The construction process is explicit: select a legislative framework within a lawyer’s domain of expertise; identify technically complex provisions essential to the framework’s operation; locate load-bearing clauses where small changes could have large downstream effects; and introduce subtle alterations that serve plausible purposes while breaking core functionality (Sadler et al., 12 Aug 2025). Creating a single puzzle typically requires 3–10 hours of expert lawyer time (Sadler et al., 12 Aug 2025).

Each puzzle contains three artifacts: the original legislation or legal framework, a modified act containing introduced vulnerabilities, and a detailed explanation of the legal logic showing why the modification creates significant problems (Sadler et al., 12 Aug 2025). The dataset spans multiple jurisdictions and legal domains, including telecommunications, food safety, data privacy, electronic transactions, copyright, and citizenship law (Sadler et al., 12 Aug 2025). Because legal materials can be very long, the authors use strategic abridgment, retaining only sections necessary for solving the puzzle while fitting current context-window and API constraints (Sadler et al., 12 Aug 2025).

The evaluation protocol uses the UK AI Security Institute’s Inspect framework. Models receive the original legal framework plus the modified act and are prompted to act as strategic legal reviewers for Australia’s Office of Parliamentary Counsel, identifying critical failures, gaps, or loopholes before legislation takes effect while ignoring trivial typographical or formatting mistakes (Sadler et al., 12 Aug 2025). They must explain what the error is and why it would be consequential (Sadler et al., 12 Aug 2025). Responses are compared to an expert-written target answer using an AI judge; on a ground-truth set of 25 human-graded responses, the primary automated judge, o3-2025-04-16, matched the human scores perfectly with $F1 = 1.0$ (Sadler et al., 12 Aug 2025).

The methodology targets a capability distinct from standard legal QA. Conventional legal benchmarks often test retrieval, issue spotting, summarization, or generic doctrinal reasoning. Legal puzzles instead test whether a model can discover a non-obvious, strategically consequential flaw introduced into a legal framework and explain why it matters operationally (Sadler et al., 12 Aug 2025). This suggests that the benchmark is closer to adversarial auditing of legal systems than to bar-exam-style performance.

5. Empirical results and present capability limits

Empirically, the benchmarked results are low across all evaluated frontier models. The reported accuracies are: gemini-2.5-pro-preview-05-06 at 10.00% ± 13.50; o3-2025-04-16 at 6.67% ± 9.70; gemini-2.5-flash-preview-05-20 at 5.19% ± 5.26; claude-sonnet-4-20250514 at 3.33% ± 3.50; claude-opus-4-20250514 at 2.22% ± 3.35; and o4-mini-2025-04-16 at 1.85% ± 2.78, with the intervals reported as 95% confidence intervals (Sadler et al., 12 Aug 2025). The best model therefore achieved only 10% accuracy (Sadler et al., 12 Aug 2025).

The interpretation offered in the paper is cautious. Current frontier AI models may not reliably find impactful Legal Zero-Days, and the narrow spread from lowest to highest score suggests that no evaluated model has robust mastery of the task (Sadler et al., 12 Aug 2025). At the same time, nonzero success rates indicate that the capability is not purely hypothetical (Sadler et al., 12 Aug 2025). The authors therefore treat Legal Zero-Day discovery as a frontier capability rather than a mature one (Sadler et al., 12 Aug 2025).

This present weakness parallels findings from software-security benchmarks. In ZeroDayBench, LLM agents were evaluated on 22 novel critical vulnerabilities in open-source repositories and were found not yet capable of autonomously solving the tasks reliably under low-information zero-day conditions (Lau et al., 2 Mar 2026). Zero-day pass rates were only 12.8% for Claude, 14.4% for GPT, and 12.1% for Grok, with much higher performance only when stronger hints or full information were supplied (Lau et al., 2 Mar 2026). A plausible implication is that both legal and software zero-day discovery remain difficult for current systems when the task requires genuine out-of-distribution search rather than diagnosis with strong contextual guidance.

Model	Accuracy
gemini-2.5-pro-preview-05-06	10.00% ± 13.50
o3-2025-04-16	6.67% ± 9.70
gemini-2.5-flash-preview-05-20	5.19% ± 5.26
claude-sonnet-4-20250514	3.33% ± 3.50
claude-opus-4-20250514	2.22% ± 3.35
o4-mini-2025-04-16	1.85% ± 2.78

6. Case study, governance significance, and limitations

The principal motivating case is the 2017 Australian dual citizenship crisis. The relevant constitutional provision was Section 44(i) of the Australian Constitution, in force since 1901, which disqualifies dual citizens from serving in Parliament (Sadler et al., 12 Aug 2025). The paper treats the crisis as a latent legal vulnerability arising from the interaction between Australian constitutional law and diverse foreign citizenship regimes, with discovery producing immediate consequences: the Deputy Prime Minister was forced to resign, the government’s parliamentary majority was threatened, numerous administrative decisions were potentially invalidated, and normal government functioning was paralyzed for roughly 18 months (Sadler et al., 12 Aug 2025). In the paper’s account, this satisfies all five Legal Zero-Day criteria (Sadler et al., 12 Aug 2025).

The significance of the case is analytical rather than doctrinal. It is used as an exemplar showing how a long-dormant legal interaction can generate immediate governance disruption once recognized, even though the underlying legal text did not suddenly change (Sadler et al., 12 Aug 2025). The paper also mentions other suggestive examples, such as New Zealand’s 2013 discovery that oaths of office had been incorrectly administered and instances of mass prisoner releases due to legal process errors (Sadler et al., 12 Aug 2025). These examples support the claim that legal systems may contain more hidden vulnerabilities than is commonly appreciated.

The paper’s governance argument is that Legal Zero-Days function as a risk multiplier. They may not be catastrophic in isolation, but they can undermine safeguards and magnify other risks by weakening the legal infrastructure used to govern advanced AI itself (Sadler et al., 12 Aug 2025). The recommendations are directional rather than architecturally detailed: expand dangerous-capability evaluations to include legal vulnerability discovery, improve legal robustness, use legal puzzles and adversarial evaluation as safe monitoring instruments, and prepare for periods of regulatory paralysis or constitutional uncertainty (Sadler et al., 12 Aug 2025).

The limitations are substantial and explicitly acknowledged. Legal puzzles cannot capture the full scale, complexity, and interconnectedness of real legal systems; abridgment may make the task easier than real-world discovery; each puzzle appears to permit only one correct answer; data leakage remains possible when using existing legislation; and solving a crafted puzzle is not the same as finding and exploiting an unknown live vulnerability in an operating legal system (Sadler et al., 12 Aug 2025). These constraints mean that the empirical contribution is a benchmarked capability assessment, while the larger claims about future autonomous systems accumulating Legal Zero-Days remain forward-looking. This suggests that the concept is best treated, at present, as a rigorously framed warning category: empirically weak in current models, but potentially consequential because legal and constitutional infrastructure is slower to patch than software and may be central to AI governance itself (Sadler et al., 12 Aug 2025).