AI-assisted bug hunting accelerates vulnerability disclosures, straining patching capacity

Widely available AI tools are accelerating the discovery of software vulnerabilities, pushing monthly CVE disclosures to record highs and straining under-resourced security teams. Microsoft reported issuing patches for 974 CVEs in a single month, setting a new record, while Oracle shipped 1,448 patches in July—nearly five times the 309 patches issued in July 2025. Google Chrome’s two major version releases in June included 1,072 patches, exceeding the total number of fixes from all 23 prior big releases combined. Mozilla disclosed that it found 271 vulnerabilities in Firefox during a single bug-hunting sprint using Anthropic’s Mythos model.

The surge in disclosed vulnerabilities is reflected in broader CVE tracking data. As of September 16, 2026, a total of 66,401 CVEs had been recorded, nearly double the 33,512 logged by the same date in 2025. For context, the total number of CVEs recorded in all of 2022— the year OpenAI launched its first version of ChatGPT—was 25,000. Researchers note that while the increase in known vulnerabilities reflects a system working to identify flaws, it also raises concerns about whether developers and users can keep pace with patching.

Experts are divided over whether the AI-driven surge in vulnerability discovery will prove catastrophic or merely magnify existing challenges. Some argue that slow patch adoption and underinvestment in cybersecurity have already given attackers significant advantages, regardless of AI. Others warn that AI could tip the balance further by enabling more attackers to discover novel vulnerabilities faster. The UK’s National Cyber Security Center has emphasized that simply finding vulnerabilities does not improve security without effective remediation.

Security leaders describe a tenuous balance between AI accelerating bug discovery and AI aiding defenders. Matthew Olney, director of threat intelligence at Cisco Systems, notes that both malicious actors and defenders are exploring where to deploy AI. The current situation suggests that even if AI development were slowed through regulation or industry accords, the vulnerability surge driven by existing AI tools is already underway and unlikely to abate.

The gap between discovery and remediation remains a critical challenge. As Jerry Gamblin, head of research at Empirical Security and founder of RogoLabs, observes, discovery scales with compute, but remediation scales with people—a resource that cannot be expanded quickly. This dynamic underscores the need for investment in security teams and processes to avoid a widening exposure gap as AI-driven discovery accelerates.