AI-assisted tools are helping researchers and vendors identify software flaws at a pace that can overwhelm validation, patching and deployment. The security crisis is not simply that more vulnerabilities are being found: it is that fixes must travel through a software supply chain while attackers can exploit some disclosed flaws before every affected system is updated. That makes defender capacity, exposure and patch adoption as important as discovery speed.
What the latest vulnerability numbers show—and what they do not
Google Threat Intelligence Group (GTIG), analyzing disclosures from January 1, 2025 through August 31, 2026, recorded a sharp increase in monthly disclosed vulnerabilities. It also observed more exploitation. Those are related trends, but disclosure totals are not a count of successful attacks, and they do not establish that AI caused the increase.
As an Amazon Associate I earn from qualifying purchases.
| Measure | GTIG finding | How to interpret it |
|---|---|---|
| Monthly disclosures | 5,045 in January 2026; 10,740 in August 2026 | Disclosures rose over this period. The total can be affected by how organizations assign vulnerability identifiers. |
| Average vulnerabilities observed exploited per month | 10.5 in 2025; 18 per month from January through August 2026 | GTIG’s observed exploitation measure, not a count of all attacks or a rate that applies to every vulnerability. |
| Average zero-day exploitation | 8 per month in 2025; 11 per month from January through August 2026 | Zero-days are one part of exploitation; GTIG says n-day weaponization accounts for more of the growth than a surge in zero-days. |
| Distinct vulnerabilities disclosed and exploited | 141 from January through August 2026; 127 during all of 2025 | The eight-month 2026 total exceeded the prior full-year total in GTIG’s tracking. |
| High-risk vulnerabilities exploited | 28 in 2025; 75 from January through August 2026 | GTIG’s own Vulnerability Risk Ratings define “high-risk”; these are not CVSS scores. |
| Share of 2026 disclosed vulnerabilities observed in active exploitation | 0.23%, or roughly 1 in 431 | Most disclosed vulnerabilities were not observed in active exploitation in GTIG’s analysis. |
GTIG cautions that raw CVE counts can mislead. Automated assignment policies can generate many identifiers: its analysis cites approximately 5,000 Linux Kernel CVEs in January–August 2026, with zero observed exploited in-the-wild zero-days among them. A larger disclosure count therefore does not mean every entry is equally serious, exploitable or urgent.
What AI-assisted discovery reports add
Vendor announcements show substantial program-specific findings, but their numbers should not be mistaken for independently audited global totals. Anthropic’s May 22, 2026 Project Glasswing update said that after one month its partners had collectively found more than 10,000 high- or critical-severity vulnerabilities; several partners reported bug-finding rates more than ten times higher. Anthropic said Cloudflare found 2,000 bugs, including 400 rated high or critical, in critical-path systems.
#1 Best Overall
In the same update, Anthropic said it had scanned more than 1,000 open-source projects and estimated 6,202 high- or critical-severity findings among 23,019 findings across severity levels. Separately, its February 5, 2026 account of open-source work with Claude Opus 4.6 reported more than 500 high-severity vulnerabilities found and validated, with reporting and patching under way with maintainers—not a claim that all findings were already fixed.
OpenAI’s June 22, 2026 Daybreak announcement reported that, since its March research preview, Codex Security had scanned over 30 million commits across more than 30,000 codebases. The company said human reviewers marked more than 70,000 findings fixed and more than 500,000 findings were automatically determined to be fixed. These are vendor-reported product usage figures, not an independent comparison of efficacy.
Why finding a flaw is not the same as fixing it
A vulnerability response has several separate stages: discovery identifies a possible flaw; validation confirms whether it is real and determines its impact; disclosure informs maintainers or the public; patch development and testing produce a safe correction; downstream integration brings that correction into dependent products; and patch adoption updates systems in use. Faster discovery accelerates only the first stage unless the rest of the process can keep up.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Anthropic described the bottleneck in its Project Glasswing update this way: “Now it’s limited by how quickly we can verify, disclose, and patch the large numbers of vulnerabilities found by AI.” OpenAI made a related point in its Daybreak announcement: “Vulnerability reports, on their own, do not protect anyone.” OpenAI describes validation, impact assessment, patch development and testing, disclosure coordination and deployment as parts of a defensive workflow, with people retaining control over which findings to investigate, changes to apply and information to share.
AI output still needs security judgment
A scanner or model can generate findings that need verification. Teams must establish that an issue is reproducible, determine whether affected code is reachable in the relevant product, assess consequences and rule out false positives. A plausible report is not proof of a working exploit, and a severity label alone does not tell an operator whether a particular asset is exposed or vulnerable in its configuration.
The potential offensive use also deserves careful qualification. In a company-run evaluation described by Anthropic on June 8, 2026, Claude Mythos Preview autonomously produced eight working code-execution exploits across 18 recent Firefox security patches and eight full exploit chains from 21 Windows kernel patches. Those results show what the model achieved against those specific targets in that evaluation; they do not show that all attackers can exploit all patched systems at those rates. Anthropic also notes that real campaigns require steps such as finding targets, delivering an exploit and evading defenses.
How quickly can hackers exploit a vulnerability after disclosure?
There is no single interval that applies to every flaw. A vulnerability can be exploited before public disclosure if an attacker learns about it while it is still unknown to or unfixed by the maintainer. This is commonly called a zero-day, although usage of the term varies. An n-day is publicly disclosed and has a patch, but some systems remain unpatched.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11For an n-day, public disclosure and patch publication can give attackers useful clues. By comparing the fixed software with its earlier version—a technique called patch diffing—an attacker may infer what changed and investigate how to exploit the weakness. That does not mean every patch can be turned into a working exploit, or that exploitation is instantaneous. It does mean that publishing a fix is not the end of the security work: affected installations still need to receive it.
Google Project Zero describes an earlier stage as the upstream patch gap: the original vendor has made a fix, but downstream dependents have not yet incorporated it into their products. Its 2025 transparency trial keeps its own “90+30” policy: a vendor has 90 days to fix a reported bug before disclosure, with a 30-day patch-adoption period when a fix arrives before the deadline. That is Project Zero’s disclosure policy, not a universal industry rule.
Why patches get delayed across the software supply chain
A fix for a software component may need to pass through several organizations before it reaches the people who rely on it. The upstream maintainer may create and test a patch; an operating-system vendor, cloud provider, device maker or other integrator may need to adapt it; an operator may schedule deployment around service requirements; and an end user or IT team may still need to install or enable the update. A fix available upstream does not establish that every downstream product includes it.
- Validation and engineering: maintainers need to confirm the issue and make sure a change addresses it without breaking functionality.
- Integration: dependent products may use a different version, carry local modifications or require their own release and testing cycle.
- Deployment constraints: critical services, legacy systems and devices with limited maintenance windows can be difficult to update quickly.
- Adoption: an update that has been released but not installed leaves the affected system in the patch gap.
For this reason, “time to patch” should not be treated as one number. Measure separately the time from report to validated fix, from upstream fix to downstream release, and from release to actual deployment. That shows where remediation is getting stuck.
How organizations should prioritize security patches
Trying to treat every CVE as equally urgent is not workable when finding and disclosure volumes grow. CISA’s August 26, 2026 announcement about its FY2024–2025 Vulnerability Review identifies poor patching and continued use of end-of-support technology as basic contributors to compromise. Its prioritization framework considers exposure, whether a flaw appears in the Known Exploited Vulnerabilities (KEV) catalog, the potential for exploitation to be automated and technical impact.
Best Value
- Build an accurate asset inventory. Record internet-facing and business-critical systems, software versions, owners and dependencies. Without that map, teams cannot reliably tell which products are affected or whether a patch reached them.
- Rank risk using operational context. Check known exploitation, exposure, potential for automated exploitation and technical impact. A CVSS score can inform assessment, but should not be the sole ordering rule.
- Validate findings before escalating them. Reproduce AI-generated reports where possible, confirm affected versions and assess reachability and impact in the actual environment.
- Test and track remediation. Record the affected versions, the tested fix, release status and deployment status. Where a change causes problems, teams also need a way to manage rollback safely.
- Coordinate through downstream products. Tell relevant integrators and operators what is affected and follow the fix through to the product and installation, not just the original component.
- Reduce exposure while work continues. Limit exposure where feasible and plan to retire unsupported systems that cannot receive a suitable fix.
- Measure the separate delays. Track report-to-validation, validation-to-fix, upstream-fix-to-downstream-release and release-to-deployment times to identify the actual bottleneck.
What to look for in vulnerability-management tools
Tools can support inventory, code analysis, validation, prioritization and deployment tracking; they cannot by themselves coordinate every maintainer, integrator and operator. When assessing a vulnerability-management or application-security tool, compare its operational coverage and evidence, not just the number of findings it reports.
| Evaluation area | Questions to ask |
|---|---|
| Coverage | Does it cover the organization’s source code, dependencies, cloud assets, network appliances and downstream products—or only some of them? |
| Validation quality | Can it show reachability, exploitability and reproducible evidence? How are false positives handled? |
| Prioritization | Does its ordering account for exposure and known exploitation as well as technical severity? |
| Remediation workflow | Can teams generate or test fixes, review changes, track deployment and manage rollback? |
| Supply-chain visibility | Can a finding in an upstream component be traced into dependent builds and releases? |
| Operational fit | Does it integrate with existing systems, support legacy environments and show remediation progress without adding unmanageable staff workload? |
The relevant measure of success is not how many warnings a product produces. It is whether teams can identify the flaws that matter, validate them, get safe fixes through dependent products and verify that exposed systems actually received those fixes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
