AI-Assisted Vulnerabilities Show Low Exploitation Rates in 2026

In the first half of 2026, VulnCheck reported a significant increase in CVEs, with 495 known exploited vulnerabilities (KEVs) identified. Despite the rise in AI-assisted vulnerability discovery, only 1.3% of AI-found vulnerabilities have been exploited, similar to the overall exploitation rate. The report indicates that while AI tools like Anthropic's Project Glasswing have identified numerous potential flaws, the actual weaponization of these vulnerabilities remains low. The median time from CVE publication to KEV status decreased from 120 days to 80 days, suggesting faster recognition of threats. CISA has issued guidance recommending rapid remediation for vulnerabilities with evidence of exploitation. The overall KEV-to-CVE ratio has declined, indicating that while more vulnerabilities are being disclosed, fewer are being exploited. This trend raises questions about the effectiveness of AI in enhancing real-world attack capabilities.

Key Points: • Only 1.3% of AI-assisted vulnerabilities have been exploited, similar to overall rates. • 495 known exploited vulnerabilities were identified in the first half of 2026. • CISA recommends rapid remediation for vulnerabilities with evidence of exploitation.