AI-generated editorial illustration; not a documentary photograph.
AI-assisted bug hunting is contributing to a steep rise in disclosed software flaws, creating a widening remediation burden for developers, security teams and open-source maintainers. According to data cited by WIRED, 66,401 common vulnerabilities and exposures, or CVEs, had been recorded by September 16, 2026, nearly double the 33,512 logged by the same date in 2025.
Patch Volumes Climb
Major software vendors are processing unusually large numbers of fixes. Microsoft said it had issued patches for 974 CVEs so far in September, a monthly record. Oracle shipped 1,448 patches in July, compared with 309 in July 2025. Two major Google Chrome releases in June contained 1,072 patches, exceeding the combined vulnerability fixes in the browser's previous 23 major releases.
AI Expands Discovery
Mainstream AI products, including open-weight models, can now help researchers identify flaws at greater scale. Mozilla said in April that a bug-hunting sprint using Anthropic's Mythos model found 271 vulnerabilities in Firefox. The increase builds on established security research rather than replacing it, but AI is accelerating the rate at which potential weaknesses can be surfaced.
RogoLabs founder Jerry Gamblin's cve.icu project recorded 25,000 CVEs during all of 2022, the year OpenAI released the first version of ChatGPT. The 2026 total had already passed 66,000 by mid-September, although the figures show growth in known vulnerabilities rather than directly measuring the amount of insecure software.
Remediation Is the Bottleneck
The immediate constraint is organizations' capacity to validate reports, develop fixes and deploy patches. Under-resourced IT teams and volunteers maintaining important open-source projects may struggle to keep pace even when faster discovery improves visibility into existing problems.
Researchers cited by WIRED remain divided over the scale of the resulting cyber risk. Attackers may also use AI to find previously unknown flaws, while defenders can apply the same technology to detection. Slow patch adoption and limited security investment already favored attackers before AI-assisted research became widespread.
More Findings, Not Automatic Harm
A higher CVE count does not by itself prove that software has become more vulnerable. It can indicate that discovery and disclosure systems are working more effectively. The material risk arises when findings accumulate faster than developers and users can remediate them, leaving known weaknesses exposed despite their formal identification.
Source: Forget the AI Slowdown—the Vulnerability Explosion Is Already Happening
SIGNAL TITANS
Leave a Reply