Loading story…
The U.K. National Cyber Security Centre warned that artificial intelligence is accelerating the discovery of software vulnerabilities and could trigger a large-scale "patch wave" of urgent updates across enterprise technology stacks. NCSC CTO Ollie Whitehouse said sufficiently skilled attackers can use AI to uncover hidden flaws faster, raising the likelihood of rapid exploitation in widely used and legacy software amid significant technical debt and a worsening threat environment that already includes serious incidents and nationally significant attacks.
The agency urged organizations to prioritize patching of internet-facing, perimeter, and other critical systems, reduce exposed attack surface, and prepare for faster and more frequent update cycles across supply chains. It also said patching alone will not be enough for unsupported or end-of-life technology, recommending replacement or renewed vendor support where possible, alongside broader measures such as automated updates, risk-based prioritization, stronger cyber hygiene, safer software design, and improved detection and threat hunting in higher-risk environments.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
The UK government published guidance stating that public-sector organizations should remain open by default when publishing source code despite AI accelerating vulnerability discovery. It said exploitation risk is driven more by insecure design, poor dependency hygiene, and slow remediation than by code visibility, and recommended minimum operational standards such as named ownership, automated scanning, vulnerability reporting channels, and defined patching timelines.
Google Cloud Threat Intelligence reported that AI is already helping threat actors identify vulnerabilities, generate exploit code, automate reconnaissance, and scale attacks across cloud and AI environments. The report highlighted what Google described as the first known AI-developed zero-day exploit tied to a planned mass exploitation event, along with growing attacker focus on insecure APIs, SaaS platforms, developer tools, and exposed AI integrations.
Alongside the warning, the NCSC advised organizations to prioritize internet-facing and critical systems, automate updates where possible, and prepare for more frequent patching cycles. The agency also said patching alone may be insufficient for legacy or end-of-life technologies and recommended replacing unsupported systems or restoring vendor support.
The U.K. National Cyber Security Centre warned that artificial intelligence is accelerating the discovery of software vulnerabilities and could lead to a large-scale wave of urgent security patches. NCSC CTO Ollie Whitehouse said skilled attackers could use AI to uncover hidden flaws faster, increasing the risk of exploitation across widely used and legacy software.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
7 references tracked. Mallory keeps watching after this page renders.
gov.uk
Open sourcetomshardware.com
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcebugflation.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rapid7 reported that AI-driven vulnerability discovery and faster attacker operationalization are outpacing traditional patch management, with high and critical vulnerability disclosures rising from 4,268 in Q2 2025 to 8,539 in Q2 2026. Newly exploited vulnerabilities also increased 8% to 40, and 25 of those were so-called **"Holy Grail"** flaws requiring neither credentials nor user interaction, underscoring how quickly attackers can capitalize on high-impact exposures. The report also linked the pressure to persistent nation-state activity from China, Russia, Iran, and North Korea, alongside continued ransomware operations by groups including **Qilin**, **The Gentlemen**, **DragonForce**, **Akira**, and **LockBit**. Health-ISAC said the problem is especially acute in healthcare, where patching delays are often built into clinical operations because updates may require vendor validation, hospital testing, scheduled downtime, change-control approval, and sometimes regulatory review. Systems such as MRI platforms can remain exposed while those processes play out, giving attackers time to exploit weaknesses that AI helps identify and weaponize faster. Both reports said organizations should move beyond monthly patch cycles and **CVSS**-only prioritization, and instead focus on reducing reachable, high-impact exposure during the window when patches cannot yet be deployed.
Aug 20, 2026
Researchers and security leaders at **Black Hat USA 2026** warned that AI is sharply increasing the rate of software vulnerability discovery, raising concerns that defenders may struggle to keep pace with disclosure and remediation. The discussion highlighted research from Arizona State University led by Yan Shoshitaishvili, which found that AI-assisted workflows and training on characteristics of previously identified bugs significantly boosted the number of flaws uncovered. The surge in findings is colliding with growing defensive pressure, including high recent Microsoft Patch Tuesday `CVE` volumes and the U.S. government's new **Gold Eagle** initiative to coordinate vulnerability research, mitigation, and fixes. Speakers cautioned that discovery may now be outpacing responsible disclosure and patching capacity, increasing the risk of exposed systems and hurried fixes, while also arguing that sustained AI-driven research could eventually reduce long-standing bug backlogs and improve software security overall.
Aug 14, 2026
European and national cyber authorities are warning that AI is rapidly increasing the speed and scale of vulnerability discovery and exploit development, raising the prospect of a sustained remediation crisis. The European Central Bank told about 110 major banks to assess AI-enabled cyber threats and submit action plans by **October 31, 2026**, while the European Systemic Risk Board and European Supervisory Authorities issued parallel warnings on systemic risk from frontier AI models. In France, ANSSI Director General Vincent Strubel told senators that AI-assisted discovery could create a multi-year **"patch wall"**, overwhelming remediation teams even as basic controls such as network segmentation, identity and access management, and timely patching remain the most effective defenses. Industry reporting and vendor disclosures show why regulators are escalating. Mozilla said frontier AI models helped identify **271 vulnerabilities** fixed in Firefox 150 after an earlier run found 22 security-sensitive bugs, while researchers and commentators say LLM-assisted patch diffing can shrink the path from a disclosed `CVE` to a working proof of concept to days or even hours, including for flaws such as `CVE-2025-32433` in Erlang/OTP SSH. At the same time, access controls around advanced cyber-capable models are tightening unevenly: Anthropic expanded its restricted **Project Glasswing** program for Claude Mythos to critical-infrastructure organizations, but open-weight alternatives such as Zhipu AI's **GLM-5.2** are reported to deliver competitive vulnerability-finding performance at lower cost, reinforcing concerns that powerful offensive-relevant capability is spreading faster than most enterprises can patch.
Jul 10, 2026