At three in the morning, the machines are still hunting. Thousands of tireless researchers split across millions of lines of code, following faint traces through forgotten libraries and abandoned interfaces. By sunrise, they can return with more suspected flaws than a human security team could investigate in a month. Somewhere else, another fleet is asking a darker question: which of those flaws can be turned into a working attack before the first patch reaches production?
That is no longer science fiction. Frontier models can sustain multi-day vulnerability-research campaigns, and specialist agents are beginning to discover previously unknown flaws in real software. Open-weight systems are following only months behind the closed frontier. Meanwhile, the institutions that catalogue vulnerabilities, the maintainers who repair them and the enterprises that deploy fixes are already struggling with the existing workload. The danger is real—but the popular version of the argument is still too simple.
The short answer
The central claim is directionally right. AI is lowering the cost of searching for vulnerabilities, validating them and, increasingly, developing exploits. Discovery can now scale with compute rather than with scarce expert hours. The remediation side does not scale as easily because a safe fix still has to be understood, tested, assigned to an owner, released, deployed and verified across messy real systems.
But a raw vulnerability count is a poor measure of danger. Most published CVEs are never observed being exploited, while a relatively small set of internet-facing and high-value flaws drives disproportionate harm. More AI-generated findings could overwhelm weak programmes with noise—or strengthen defence—depending on whether discovery is connected to validation, prioritisation and verified remediation.
The decisive contest is not AI versus humans. It is an attacker’s automated discovery-to-exploit pipeline versus a defender’s automated discovery-to-fix pipeline. Organisations that leave human teams manually joining asset data, tickets, tests and deployment records will fall behind. Those that give defenders governed access to the same class of models may compress the patch cycle as sharply as attackers compress exploitation.
What the evidence supports—and what it does not
| Claim | Best available evidence | Assessment |
|---|---|---|
| AI is producing a vulnerability flood | FIRST projects roughly 66,000 CVEs in 2026 and identifies AI-assisted discovery as one driver. It also attributes the surge to better reporting, new products and the processing of old backlogs. | Supported, with qualification. AI is one cause, not the only cause. |
| Organisations cannot patch everything | NIST increased NVD enrichment output but still could not keep pace. Verizon reports that only 26% of known-exploited critical vulnerabilities were fully remediated in 2025, with a 43-day median to full resolution. | Strongly supported. The bottleneck already exists. |
| The exploitation window is collapsing | Mandiant’s average observed time-to-exploit fell from 63 days in 2018–19 to five days in 2023, although the number is sensitive to methodology and mixes zero-days with post-disclosure exploitation. | Supported as a trend. AI is not yet proven to be the sole cause. |
| Open weights remove the defender’s head start | UK AISI finds leading open-weight models only four to seven months behind the closed cyber frontier, cheaper to run and largely unimpeded by safeguards. | A credible near-term risk. It is a distribution and control problem as much as a capability problem. |
The discovery curve has changed shape
The most important change is economic. Traditional vulnerability research is constrained by the number of expert researchers and the hours they can devote to one codebase. An agent can preserve context, call debuggers and fuzzers, generate test cases, reject dead ends and run many investigations in parallel. Once the harness is built, another thousand attempts are primarily a compute purchase.
OpenAI’s GPT-5.5 system card reports that the model sustained multi-day campaigns, produced reproducible proof-of-concept inputs and found credible memory-safety leads in hardened software. It did not independently produce a verifier-confirmed critical exploit in the tested standard configurations; exploit-development judgement remained the bottleneck. That limitation matters. The evidence shows rapidly improving automation of serious research, not a machine that can reliably break any target on demand.
Other results show the trajectory. Google says its specialist Gemini 3.5 Flash Cyber system found 55 confirmed issues in a fixed set of V8 investigations and, in an internal exercise, developed a reliable remote-code-execution exploit within two hours. Those are vendor-reported results and should be treated accordingly, but they demonstrate why inference cost and parallel search matter. The earlier Big Sleep result supplied a cleaner public milestone: an agent found a previously unknown exploitable memory-safety flaw in SQLite, and maintainers fixed it before it reached an official release.
The volume data now reflects this broader transformation. The official CVE programme metrics record 28,961 published records in 2023, 40,077 in 2024 and 48,244 in 2025. FIRST’s mid-year forecast projects roughly 66,000 in 2026. FIRST attributes the rise partly to AI-assisted research, but also to a 449% increase in GitHub Security Advisory volume, a large backlog being absorbed by a catch-all numbering authority and a much wider population of monitored products. More findings therefore mean better visibility as well as more insecure software.
The remediation curve is still human-shaped
Finding a bug is only the beginning. Someone must reproduce it, establish severity, identify affected versions, find the responsible team, design a fix, avoid regressions, coordinate disclosure, publish the update, deploy it across dependencies and prove that the vulnerable instances have disappeared. Each hand-off involves ownership, risk and change control. That is why discovery can scale faster than remediation even when models can also write patches.
The stress is visible in public infrastructure. NIST says CVE submissions rose 263% from 2020 to 2025. It enriched nearly 42,000 records in 2025—45% more than in any previous year—yet still could not clear its backlog. In April 2026 it moved to a risk-based system that prioritises known-exploited and critical-software vulnerabilities rather than attempting immediate enrichment of every record. The global catalogue itself has been forced to triage.
Enterprise deployment is slower still. The 2026 Verizon DBIR reports that vulnerability exploitation became the leading initial-access vector in its breach dataset, at 31%. Only 26% of the vulnerabilities in scope that were both critical to the organisation and present in CISA’s Known Exploited Vulnerabilities catalogue were fully remediated during 2025. Median full resolution took 43 days. Even allowing for differences in scope and measurement, the contrast is stark: attackers often operate in days; defenders still measure end-to-end repair in weeks.
A shrinking window—but not a single clock
The claim that disclosure and exploitation are converging is broadly correct. Mandiant’s longitudinal analysis found that average observed time-to-exploit fell from 63 days in 2018–19 to 44 days in 2020–21, 32 days in 2021–22 and five days in 2023. In that 2023 sample, 29% of vulnerabilities first exploited after a patch became available were attacked within a week and 56% within a month.
But “five days” is not a universal countdown. Mandiant’s figure combines vulnerabilities exploited before and after disclosure, excludes statistical outliers and rises to 47 days when those outliers are retained. Among cases where exploitation followed disclosure, the median was 43 days when public exploit code existed beforehand. Value, exposure, reliability and attacker demand matter more than headlines alone. AI will probably compress parts of this chain, but the historical decline began before modern frontier agents and cannot be attributed to them without better causal evidence.
The UK’s National Cyber Security Centre makes the most defensible forward judgement: AI will almost certainly improve reconnaissance, vulnerability research and exploitation of known flaws, while fully automated advanced end-to-end attacks remain unlikely through 2027. Human-machine teams are the immediate threat. Skilled operators will use agents to search, adapt and scale; humans will still choose targets, manage operational security and make the difficult exploit decisions.
Why open-weight models alter the balance
Open weights do not automatically make a model more dangerous. They change who controls it. A hosted provider can monitor suspicious use, rate-limit campaigns, strengthen filters, revoke accounts and withdraw a model. Once capable weights are public, those controls become optional. Operators can remove refusals, fine-tune for a target, run privately, preserve a fixed version and spend as much compute as they can afford.
UK AISI’s 2026 comparison puts the issue in concrete terms. Its leading open-weight systems performed similarly to closed models released only four to seven months earlier, narrowing a gap that had generally been six to ten months during 2025. They were cheaper on the tested tasks, and safeguards rarely impeded them. That does not prove mass exploitation is imminent, but it shortens the period in which responsible providers can give vetted defenders privileged access to frontier capability before a similar level becomes permanently downloadable.
The openness also benefits defence. Organisations can inspect and adapt models, keep sensitive source code on premises and run continuous research without sending proprietary data to a provider. The policy choice is therefore not “open is bad, closed is safe”. It is whether defensive deployment, secure defaults and remediation capacity can mature during that shrinking capability lag.
The counterargument: AI can scale the fix as well
The strongest reason not to accept a fatalistic vulnerability-deluge narrative is that the same technology can work on both sides of the queue. In DARPA’s 2025 AI Cyber Challenge, autonomous systems found 54 of 63 synthetic vulnerabilities and patched 43. They also discovered 18 previously unknown real flaws and supplied 11 patches; submissions took an average of 45 minutes. These were controlled competition results, not proof that arbitrary enterprise software can be safely repaired without review, but they show that remediation is becoming automatable too.
Google’s CodeMender offers a real-world complement. Google reported 72 security fixes upstreamed to open-source projects during its first six months, using program analysis, fuzzing and multi-agent critique to validate patches before human review. The human remains in the loop, but is reviewing a tested candidate rather than beginning with a crash and an empty editor.
This is the possible defensive advantage: vendors possess the source code, tests, build systems, asset inventory and authority to deploy. An attacker must infer those things from the outside. If defenders connect those privileged inputs to governed agents, they can search earlier and repair closer to the point of development. If they simply buy another scanner, they will create a larger queue.
What organisations should do now
- Stop treating every CVE as equal. Combine CISA’s Known Exploited Vulnerabilities catalogue and EPSS probability with actual asset presence, internet exposure, available controls and business consequence. FIRST’s analysis finds that actionable exploitability has not risen at the same rate as raw disclosure volume.
- Measure discovery-to-safe-remediation. A patch ticket is not a fixed system. Track time to reproduce, assign, merge, release, deploy and verify, including the long tail. Make ownership gaps and change-window delays visible to executives.
- Put defensive agents inside the software lifecycle. Give governed systems source code, build tools, tests and asset context so they can validate findings and prepare fixes. Require independent tests, bounded permissions and human approval for consequential changes.
- Use compensating controls to buy time. Segmentation, least privilege, virtual patching, exploit detection, feature disablement and rapid credential rotation can close exposure before a full software release reaches every device.
- Protect maintainers from low-quality disclosure floods. AI-generated reports should carry reproducible evidence, affected versions, root-cause analysis, duplicate checks and a candidate test or patch. Rate limits and quality thresholds should apply to automated submissions.
- Assume capable open weights will diffuse. Security plans should not depend on a provider refusing the attacker’s prompt. Use the temporary frontier advantage to harden high-value code and legacy systems before equivalent capability becomes cheaper and less governable.
Bottom line
The vulnerability crisis is not that AI will reveal an infinite number of equally dangerous bugs. It is that machines can search faster than institutions can decide: Is the finding real? Does it affect us? Who owns the fix? Can we deploy it safely before somebody else turns it into an exploit?
The organisations most at risk will be those with the largest gap between those two pipelines. Their attackers will use AI to compress discovery and exploitation while their defenders still move findings through spreadsheets, inboxes and monthly change boards. The winners will not patch everything. They will use evidence to identify the small fraction that can hurt them, give defensive automation the context attackers lack, and verify fixes at machine speed without surrendering human judgement.
The warning from the Hugging Face incident is therefore larger than sandboxing. Frontier agents can turn persistence, parallelism and cheap experimentation into operational power. The answer is not to slow discovery. It is to make trusted remediation just as continuous, just as scalable and much closer to the code.
