Glonce

AI-assisted bug hunting pushes CVE disclosures toward a record 66,401

securityThe Glonce editorsWired🔥77Glonce rating77Impact75Novelty65Relevance100Surprise60Players70Credibility85
AI-assisted bug hunting pushes CVE disclosures toward a record 66,401

In the debut edition of Wired's new security newsletter Kernel Panic, Lily Hay Newman and Matt Burgess argue that while AI safety debate has drifted toward longer-term fears of rogue AI causing mass human death, a nearer-term shift is already happening: AI-assisted vulnerability discovery, using mainstream AI products and open-weight models alike, is driving a sharp rise in disclosed software vulnerabilities (CVEs) through 2026.

The vendor numbers back it up. Microsoft said it issued patches for 974 CVEs so far this month, a new record for the company. In July, Oracle shipped 1,448 patches, compared with 309 in July 2025. Google Chrome's two major version releases in June included 1,072 patches combined, more than all the fixes shipped across the prior 23 major releases put together. Mozilla said in April that a single bug-hunting sprint using Anthropic's Mythos model turned up 271 vulnerabilities in Firefox.

Jerry Gamblin, head of research at Empirical Security and founder of RogoLabs, which runs the CVE tracking project cve.icu, put the industry-wide total at 66,401 CVEs recorded as of the Wednesday of publication week, against 33,512 logged by cve.icu on September 16 last year, almost half the current total, and just 25,000 for all of 2022, the year OpenAI launched its first version of ChatGPT.

The article lays out a real disagreement over what the surge means. Gamblin himself pushes back on treating the raw count as proof of harm: "What I would push back on is the idea that a bigger number is itself the harm. More CVEs is not more vulnerability. It's more known vulnerability, which is mostly the system working." The opposing worry, as the piece frames it, is that discovery will outpace developers' ability to patch, leaving software users exposed and handing more attackers a route to novel exploits found with AI on their own; Britain's National Cyber Security Center is quoted putting it bluntly: "Just finding vulnerabilities does nothing to improve your security." Matthew Olney, director of threat intelligence at Cisco Systems, frames the moment as both sides, attackers and defenders, still working out where AI actually helps them.

The authors close by arguing that whatever slowdown AI companies negotiate for frontier model development, whether through regulation or an industry accord, it might address the longer-term existential worry, but it cannot undo the vulnerability wave that mainstream AI tools have already set off. Gamblin's own summary: "Discovery scales with compute. Remediation scales with people, and people are the part you can't buy more of in a quarter."

Key facts

  • Microsoft issued patches for 974 CVEs so far this month (September 2026), a new record for the company.
  • Oracle shipped 1,448 patches in July 2026, up from 309 in July 2025.
  • Mozilla found 271 Firefox vulnerabilities in a single April 2026 bug-hunting sprint using Anthropic's Mythos model.
  • cve.icu recorded 66,401 CVEs so far this year, versus 33,512 by the same point in 2025 and just 25,000 for all of 2022.
  • Jerry Gamblin (Empirical Security / RogoLabs) argues the count itself isn't the danger; the strain is that remediation depends on people, who "you can't buy more of in a quarter."

Why it matters

The vulnerability surge is a concrete, already-arrived cybersecurity shift, in contrast to the more speculative, longer-horizon debate over rogue AI that has recently absorbed more attention. Multiple major vendors, not one isolated project, are reporting multiplied disclosure numbers in the same period, which points to a structural change in how software flaws get found rather than a one-off event at a single company.

Who it affects

IT and security teams at major vendors and their downstream users, across Windows, Oracle products, Chrome and Firefox; volunteer maintainers of open source software, who now face larger disclosure backlogs with the same limited staffing; and cybersecurity analysts tracking industry-wide CVE trends through projects like cve.icu.

How to use it

The piece's own takeaway, via Gamblin, is not to treat a bigger CVE count as proof of worse security by itself, since more disclosures can mean the reporting system is working. The practical action for security teams is to check whether patch pipelines and staffing can keep pace with discovery, since, in Gamblin's framing, discovery scales with compute while remediation scales with people.

How solid is it

The reporting rests on named, checkable sources: publicly disclosed patch counts from Microsoft, Oracle, Google and Mozilla, industry-wide CVE totals from cve.icu as cited by its founder Jerry Gamblin, and on-the-record quotes from a named Cisco Systems threat intelligence director and Britain's National Cyber Security Center. It is the first edition of a new Wired newsletter but is built on public vendor disclosures and named sourcing rather than anonymous claims.

Risks and caveats

The article does not quantify how many of the added CVEs were actually found using AI versus traditional methods, so the causal link between AI tools and the specific surge, while illustrated by examples like Mozilla's AI-run bug hunt, is not itself broken down with numbers. It also does not give a total for the 23 prior Chrome releases it compares against, or specify how many researchers or how much time Mozilla's sprint involved. Gamblin's own caveat, that a bigger number is "mostly the system working," argues against reading the raw increase as pure danger.

“Discovery scales with compute. Remediation scales with people, and people are the part you can't buy more of in a quarter.”

— Jerry Gamblin, head of research at Empirical Security and founder of RogoLabs