Security counts are climbing fast in 2026, and AI-assisted bug hunting is the explanation WIRED favors. In a September 19, 2026 article, WIRED argues that the effects of widely available AI vulnerability discovery are already visible, even as AI leaders debate slowing frontier-model development. The numbers are real enough to take seriously. But they measure known vulnerabilities, not necessarily existing ones, and the true bottleneck is fixing what is found.
Is AI causing more software vulnerabilities?
Not in a way the evidence can prove. WIRED reports that AI-driven discovery has accelerated in recent months and points to patch volumes and CVE records as signs. It also notes that many flaws were found and disclosed before AI-assisted hunting, and that experts disagree on whether AI will cause catastrophe or simply intensify existing problems. A rising count is a correlation with the AI era, not proof that AI alone produced it. “Explosion” is the headline’s editorial characterization, not a measured quantity.
As an Amazon Associate I earn from qualifying purchases.
Why a higher CVE count is not the same as less secure software
A CVE is a record of a disclosed vulnerability. More records mean more flaws have been found and published. Jerry Gamblin, head of research at Empirical Security and founder of RogoLabs, put it this way to WIRED: “More CVEs is not more vulnerability. It’s more known vulnerability, which is mostly the system working.”
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The flaws were presumably in the code already. If AI tools surface them sooner, defenders gain visibility, and so do attackers. The danger is not the count itself but the gap between disclosure and the fix being applied.
#1 Best Overall
The numbers behind the claim
| Figure | Source and qualification |
|---|---|
| 66,401 CVEs | cve.icu, via Gamblin in WIRED, as of the Wednesday before September 19, 2026 |
| 33,512 CVEs | cve.icu, via Gamblin in WIRED, by September 16, 2025 |
| 25,000 CVEs | cve.icu, via Gamblin in WIRED, for all of 2022 (a full year, not a year-to-date figure) |
| 1,448 patches | Oracle’s July 2026 Critical Patch Update, stated in Oracle’s advisory (the primary source) |
| 309 patches | Oracle, July 2025, as reported by WIRED; the count could not be confirmed from Oracle’s 2025 advisory page |
| 974 CVEs | Microsoft patches so far in September 2026, as reported by WIRED; not checked against Microsoft’s own release notes |
| 1,072 fixes | Two major Chrome releases in June 2026, as reported by WIRED; not checked against Google’s notes |
| 271 vulnerabilities | Found by Mozilla in one Firefox bug-hunting sprint using Anthropic’s Mythos model, as reported by WIRED; not checked against Mozilla’s announcement |
Note that the comparison periods differ: a roughly year-to-date 2026 count against a same-date 2025 count, and against a whole-year 2022 total. Even so, the 2026 total roughly doubles the 2025 figure for the same point in the year.
What a patch-volume number actually means
Oracle’s July 2026 Critical Patch Update contains 1,448 new security patches. Oracle explains that such an update bundles fixes for vulnerabilities in Oracle’s own code and in third-party components shipped with its products. A big bundle therefore reflects scope as well as discovery rate, and it does not show AI was the cause. Oracle advises customers to stay on supported versions and apply patches without delay, and says it has received reports of successful exploitation where customers had not applied patches already released.
Discovery scales faster than remediation
This is the practical core of WIRED’s story. Gamblin: “Discovery scales with compute. Remediation scales with people—and people are the part you can’t buy more of in a quarter.” Software can be scanned by machines at volume, while each finding still needs validation, prioritization, testing and deployment by staff.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →The UK’s National Cyber Security Centre makes the same point in its guidance, “10 questions to ask when using AI models to find vulnerabilities”: “Just finding vulnerabilities does nothing to improve your security.”
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Attackers are experimenting too
Matthew Olney, director of threat intelligence at Cisco Systems, told WIRED: “Actors, just like industry, are trying to figure out, ‘where do I use AI?'” The implication is that both sides are still finding their footing, so the balance between defenders and attackers is not settled.
Quick Recap
Best Value
What security teams should take from it
- Prioritize by exploitability and exposure, not by raw CVE totals. With more disclosures, triage becomes the scarce skill.
- Shorten patch cycles for supported products. Oracle’s own warning about exploitation of already-patched flaws shows that delay is where harm occurs.
- Validate AI-generated findings before they enter a remediation queue; unvetted output adds noise, not security.
- Budget for people and automation in remediation, since that, not discovery, is the constraint Gamblin identifies.
- Treat vendor-reported counts cautiously. Microsoft, Chrome and Mozilla figures above come via WIRED and should be confirmed against each vendor’s release notes before you rely on them.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
