AI-Driven Vulnerability Discovery Swells CVE Volume as Triage Struggles Persist

FIRST reported that 2026 vulnerability disclosures are running far above expectations, with cumulative CVE volume tracking 46.3% above its original forecast and adding roughly 6,420 excess entries, pushing the projected annual total to about 66,000. The organization attributed the surge to AI-assisted discovery and broader reporting pipelines tied to tools and programs including Anthropic Mythos, OpenAI GPT-5.4-Cyber, GitHub Security Advisories, and VulnCheck. Despite the jump in raw disclosures, FIRST said practical defender risk appears more stable when filtered through exploitability signals such as CISA KEV inclusion or EPSS scores above 10%, and warned that AI-generated ephemeral software may create short-lived “micro-vulnerabilities” that never reach traditional CVE registries.

Security practitioners said the growing volume is colliding with persistent limits in AI-based triage. Dark Reading reported that large language models still struggle to reliably find and prioritize vulnerabilities for application security teams, producing high false-positive rates, inconsistent results, and weak understanding of code reachability and deployment context. Pixee CTO Arshan Dabirsiaghi said organizations are being flooded by vulnerability findings and dependency update noise without enough staff to validate issues at scale, reinforcing FIRST’s view that the bottleneck has shifted from discovering bugs to human verification, coordination, patching, and detection engineering.