AI Speeds Vulnerability Discovery as Regulators and Vendors Respond

Security researchers and regulators reported that frontier AI is accelerating software vulnerability discovery and compressing defenders’ response windows, prompting new warnings for critical sectors. Canada’s Office of the Superintendent of Financial Institutions (OSFI) privately told banks and insurers that advanced models, including Anthropic’s Claude Mythos, could reduce the time available to detect, assess, and contain flaws before exploitation. A separate European threat note from Cigref described exploitation timelines collapsing to seconds, broader abuse of legitimate sessions and public-facing applications, and growing concern over autonomous offensive AI activity affecting large enterprises and financial institutions.

At the same time, multiple security studies said AI is improving coverage of known bug classes but still depends on human expertise to validate impact, chain weaknesses, and uncover novel attack paths. Bishop Fox showed AI-assisted testing helped identify issues including header-based verification bypasses and SSRF, but human analysts were needed to prove exploitability and business risk. NCC Group similarly pointed to James Kettle’s request-smuggling research, including findings tied to CVE-2025-32094 and CVE-2025-49005, as evidence that high-impact discoveries still come from deep human-led research. Vendors are also addressing AI-platform risk directly: Google said it fully mitigated the Dialogflow CX “Rogue Agent” flaw, which could have enabled persistent malicious code injection and exposure of sensitive chatbot conversations across shared project environments.