AI can find serious vulnerabilities at unprecedented speed. Can defenders keep up?

For years, discussions artificial intelligence in cybersecurity have focused on how attackers might use the technology to automate phishing, accelerate malware development or improve social engineering. Recent research suggests an equally significant transformation may already be underway on the defensive side of the equation.

Throughout 2026, IBM X-Force observed a dramatic increase in publicly disclosed vulnerabilities across major software vendors, including Microsoft, Oracle, Google Chrome and Apache. While the causes behind this increase are difficult to quantify, recent advances in AI-assisted vulnerability research demonstrate how vulnerability discovery can now occur at unprecedented scale. In August 2026, Unit 42 published a report highlighting that its autonomous vulnerability discovery platform, NOVA, identified more than 14,000 previously undiscovered vulnerabilities across nearly 4,000 open-source projects in just two months. The question is no longer whether AI can help researchers find vulnerabilities, but whether AI is changing vulnerability discovery faster than organizations are prepared to manage the risk.

Would your team catch the zero-day in time?

Join security leaders who rely on the Think for curated news on AI, cybersecurity, data and automation. Learn fast from expert tutorials and explainers—delivered directly to your inbox twice weekly. See the IBM Privacy Statement .

Vulnerability disclosures are up 578% in 2026 across major software vendors. Publicly disclosed CVEs across Microsoft, Oracle, Google Chrome and Apache increased from approximately 1,493 disclosures during January-September 2025 to more than 10,124 during the same period in 2026, representing roughly a 578% increase.

The acceleration became most apparent in Q2 2026. Vulnerability disclosure volumes remained relatively stable through the first quarter before increasing sharply beginning in April and continuing through the summer months.

55% of AI-discovered vulnerabilities were high or critical, 91% remotely accessible. X-Force analysis found that 55.2% of AI-attributed vulnerabilities were classified as High or Critical severity based on NIST National Vulnerability Database (NVD) CVSS v3 ratings , and that 91.0% were remotely accessible.

The challenge for defenders is shifting from discovery to prioritization. As AI scales vulnerability discovery, keeping pace with remediation may become more difficult than finding vulnerabilities in the first place.

The implications extend well beyond vulnerability research teams. Historically, identifying vulnerabilities and exposed assets was often the limiting factor; increasingly, the challenge is determining which findings matter most and remediating them before attackers can exploit them. Organizations should therefore prepare for larger patch cycles, greater prioritization demands, compressed remediation timelines and mounting pressure on vulnerability management programs.

Vulnerability discovery appears to have entered a new phase

IBM X-Force observed a substantial increase in publicly disclosed Common Vulnerabilities and Exposures (CVEs) across multiple major software vendors throughout 2026. Across Microsoft, Oracle, Google Chrome and Apache, publicly disclosed CVEs rose from approximately 1,493 between January and September 2025 to more than 10,124 during the same period in 2026—an increase of roughly 578%. While disclosure activity naturally fluctuates over time, the magnitude of this increase warrants closer examination.

The timing of the growth is particularly notable. Vulnerability disclosure volumes remained relatively aligned with historical baselines through the first quarter of 2026 before beginning to accelerate in April. By the summer months, disclosure activity had reached levels significantly higher than those observed during the same period in 2025. Oracle, Microsoft, Google Chrome and Apache each experienced substantial increases, suggesting the trend was not limited to a single vendor, product category or software ecosystem. The increase also aligns with the growing availability and broader adoption of frontier AI models supporting vulnerability discovery among security researchers and organizations. While the available data does not establish a direct causal relationship, the timing and scale of the increase suggest AI-assisted research may be contributing to higher vulnerability disclosure volumes.

More importantly, the consistency of the pattern raises broader questions how vulnerability research is evolving. Microsoft vulnerability disclosures increased by approximately 204% year-over-year, while Oracle, Google Chrome and Apache increased by approximately 1,292%, 2,456% and 367%, respectively. Such increases, from dozens of vulnerabilities per month to hundreds and, in some cases, thousands, suggest a meaningful change in how vulnerabilities are identified, validated, or reported, although the available data does not establish a single cause.

At the same time, recent research demonstrates that AI-assisted systems can identify vulnerabilities at unprecedented scale. The available data does not establish a direct causal relationship between AI-assisted research and increased disclosure activity. Taken together, however, these developments raise the possibility that vulnerability discovery is entering a new phase characterized by higher volumes and greater use of AI-assisted research.

AI is increasing the scale of vulnerability research

The vulnerability disclosure surge observed throughout 2026 coincides with broader advances in AI-assisted security research. While automation has supported vulnerability identification for years, recent developments suggest artificial intelligence is expanding the scale at which software can be analyzed for security weaknesses.

Research published by Unit 42 demonstrates how modern AI-assisted workflows can review source code, identify potential flaws, validate findings, generate proof-of-concepts and assist with remediation recommendations. This is all being completed at a pace difficult to achieve through traditional human-driven processes alone. If vulnerability discovery can increasingly operate at machine speed and machine scale, the growth in vulnerability disclosures observed by IBM X-Force throughout 2026 becomes considerably less surprising.

The emergence of autonomous vulnerability discovery systems alongside a dramatic increase in publicly disclosed vulnerabilities raises an important possibility: vulnerability research may be shifting from a process constrained by human bandwidth to one increasingly enabled by AI-assisted scale and automation.

The defender’s challenge has changed

The implications of AI-assisted vulnerability discovery extend beyond the number of vulnerabilities being reported. IBM X-Force analysis of 223 publicly reported vulnerabilities discovered using frontier AI models, among the most capable AI systems currently available. Of those vulnerabilities, 55.2% were classified as High or Critical severity based on NIST NVD CVSS v3 ratings, while 91.0% were remotely accessible, and 25.6% supported code execution. These findings suggest AI-assisted research is producing vulnerabilities that frequently require prioritization and remediation rather than simply surfacing a greater volume of low-risk findings.

The operational challenge is becoming more apparent, as vulnerability discovery accelerates. Security teams may be required to assess, prioritize and remediate a growing number of severe and remotely exploitable vulnerabilities within the same resource constraints and response windows. For many organizations, the limiting factor is no longer visibility into vulnerabilities, but the capacity to determine which findings present the greatest risk and respond accordingly.

At the same time, AI is reshaping the vulnerability landscape for both defenders and attackers. While defenders benefit from increased visibility into software weaknesses, adversaries gain access to the same growing volume of publicly disclosed vulnerabilities. As AI-assisted research continues to mature, organizations should expect larger patch cycles, greater triage demands, compressed remediation timelines and increasing pressure on vulnerability management programs.

Fig. 6: Key Characteristics of 223 AI-Attributed Vulnerabilities

Representative examples from the dataset include CVE-2026-4702 and CVE-2026-7474 , both of which were remotely accessible vulnerabilities capable of supporting code execution.

What defenders should do

Artificial intelligence is not only changing how vulnerabilities are discovered. It may be fundamentally changing the pace at which vulnerabilities are identified, disclosed and remediated. While the direct impact of AI-assisted research on vulnerability disclosures remains difficult to quantify, the dramatic increase observed throughout 2026 raises important questions how vulnerability research is evolving.

As vulnerability discovery continues to scale, the challenge for defenders is no longer simply discovering vulnerabilities. It is determining which vulnerabilities matter most and responding before attackers do. Practical steps defenders can take now include:

Prioritize based on risk, not volume . Focus remediation efforts on vulnerabilities with the greatest exposure, exploitability and business impact.

Reduce remediation delays . Review patching and change management processes to ensure critical vulnerabilities can be addressed quickly.

Improve visibility into exposed systems . Maintain continuous awareness of internet-facing assets, applications and services.

Leverage compensating controls when needed. Consider virtual patching and other mitigation measures when immediate remediation is not feasible.

Prepare for increasing disclosure volumes . AI-assisted research may continue to accelerate vulnerability discovery, placing greater demands on vulnerability management programs.

IBM X-Force Premier Threat Intelligence is now integrated with OpenCTI by Filigran, delivering actionable threat intelligence this threat activity and more. Access insights on threat actors, malware, and industry risks. Install the X-Force OpenCTI Connector to enhance detection and response, strengthening your cybersecurity with IBM X-Force’s expertise. Get a 30-Day X-Force Premier Threat Intelligence trial today.

Threat Intelligence Consultant

Protect secrets, manage machine identities and issue dynamic credentials for agentic AI and hybrid cloud.

Identify and prioritize vulnerabilities to strengthen security and reduce risk across your systems.

Identify, prioritize and manage remediation of security flaws to reduce exposure, strengthen defenses and support compliance.

Surface the vulnerabilities that matter most and guide teams through faster, more effective remediation to reduce risk and prevent breaches.

Explore Concert® application vulnerability management

Explore vulnerability assessment solutions