The vulnerabilities AI finds are the ones attackers want

Attackers exploited a flaw found by an AI research agent within four days of its public disclosure, and they are exploiting more vulnerabilities overall, according to new research by Google Threat Intelligence Group (GTIG).

The researchers examined vulnerability disclosure and exploitation data from January 2025 to August 2026.

Disclosures doubled, exploitation stays rare

Monthly CVE disclosures doubled in 2026, from 5,045 in January to 10,740 in August. Only 0.23% of the vulnerabilities disclosed this year, or one in 431, were observed exploited in the wild.

GTIG recorded 141 exploited vulnerabilities between January and August 2026, more than the 127 exploited in all of 2025. Zero-day exploitation grew from an average of 8 per month in 2025 to 11 per month in 2026.

The researchers suggest most of the growth in exploitation comes from n-days. “It is possible that threat actors are finding it more accessible or efficient to use LLMs and AI tools” to analyze patches, disclosure announcements and proof-of-concept code “to rapidly weaponize n-days,” they said.

GTIG rates vulnerabilities with its own risk ratings, which differ from CVSS severity scores. Exploitation of vulnerabilities it rates High Risk went from 28 in 2025 to 75 in the first eight months of 2026.

AI finds more serious flaws

Half of the vulnerabilities GTIG identified as likely discovered by AI lead to remote code execution, compared to 26% of those found by other means.

AI-discovered vulnerabilities are also less likely to be low risk. Of these, 39% were rated Low Risk and 58% Medium Risk, while vulnerabilities found by other means were 69% Low Risk and 28% Medium Risk.

The researchers say this “largely likely reflects how research programs scope and deploy these systems,” since those programs task AI agents with auditing infrastructure and sensitive privilege boundaries.

GTIG notes that public data undercounts AI-discovered vulnerabilities. CVE records have no standard tag for AI attribution, and cloud and SaaS providers often fix AI-found flaws in production without requesting CVE IDs.

Attackers moved fast on an AI-found flaw

CVE-2026-1731 , an unauthenticated OS command injection vulnerability in BeyondTrust Privileged Remote Access and Remote Support, was discovered by the Hacktron AI research agent.

Threat actors used it in targeted initial-access campaigns. GTIG saw one threat cluster exploit it within four days of public disclosure, and five more within seven days. The attackers escalated privileges, exfiltrated data and dropped payloads including SNOWLIGHT, SPARKRAT and cryptominers.

“Defensive AI agents are uncovering high-impact vulnerabilities that threat actors actively seek to exploit,” the researchers noted.

AI orchestration tools are the top target

GTIG tracked 2,076 vulnerabilities in AI-related software between January 2025 and August 2026, over 1,500 of them disclosed in 2026. Half of this year’s disclosures affect agent orchestration frameworks such as Flowise and Langflow, where attackers exploit code execution nodes “via prompt injection or crafted workflow JSONs,” the researchers explained.

Inference and serving software such as vLLM, Ollama and LiteLLM had 212 vulnerabilities disclosed in 2026. Nearly a quarter of them stem from unauthenticated API endpoints or server-side request forgery, which can let attackers bypass perimeter firewalls, use up GPU resources or extract model checkpoints.

Compromised enterprise AI gateways can expose third-party API keys and “private prompt streams containing personally identifiable information (PII) or proprietary source code,” GTIG warned.

Only a handful of AI-related vulnerabilities have been confirmed as exploited in the wild. They include a command injection flaw in LiteLLM ( CVE-2026-42271 ) that leads to host takeover and API credential theft, and two Langflow flaws (CVE-2026-5027 and CVE-2025-3248) that let attackers write files to the host or run code remotely.

GTIG expects vulnerability discovery and exploitation to keep rising in the short to medium term.

“To counter the increased risk from rapid vulnerability discovery and exploitation, organizations must transition from unprioritized mass-patching to threat-intelligence-driven triage, combining targeted edge-defense with automated, agentic remediation,” reseachers concluded.

Suspected state- hackers exploited NetScaler zero-day since early September (CVE-2026-88772)

AI coding agents leaked 13,000 internal company screenshots to public GitHub repos

OpenInfra Europe’s JFrog Artifactory instance breached, packages potentially compromised

Download: The High-Performance Team Playbook

Simplify security management with CIS SecureSuite Platform

Download: The IT and security field guide to AI adoption

Suspected state- hackers exploited NetScaler zero-day since early September (CVE-2026-88772)

AI coding agents leaked 13,000 internal company screenshots to public GitHub repos

OpenInfra Europe’s JFrog Artifactory instance breached, packages potentially compromised

OWASP Noir: Open-source static analysis tool

EU Cyber Resilience Act requirements for containers and Kubernetes