AI-Driven Vulnerability Reporting Overwhelms Security Triage and Patching

Security teams are struggling to keep pace as AI accelerates vulnerability discovery, bug bounty submissions, and pentest findings faster than organizations can validate and remediate them. Microsoft said it paid more than $20 million to 562 researchers for 2,531 eligible reports across 15 bug bounty programs, attributing a surge in submissions in part to AI-assisted research, while Cloudflare said it now uses Anthropic’s Claude Sonnet to triage bug bounty reports, filtering duplicates and routing only higher-value submissions for human review. Survey data from Pentest-Tools.com similarly found that AI-generated findings are creating large validation backlogs, with practitioners citing false positives, duplicate reports, unexploitable issues, and even fabricated CVEs as persistent problems.

The operational gap is widening as attackers move faster than defenders can patch. Dataminr reported a median patch time of 43 days versus an average attacker breakout time of 29 minutes, and ZDNET described an ecosystem-wide surge in flaws across major vendors and open source projects, including high-volume bug discovery in Chrome, Apple platforms, and the Linux kernel. Open-source maintainers are also tightening disclosure processes under strain: GNOME reduced its disclosure deadline from 90 days to 30 days for new reports and said it would stop forwarding reports to projects that ban AI-generated content. Across the industry, the trend is pushing CISOs toward exploitability-based prioritization, stronger triage workflows, and selective automation rather than relying on raw finding volume alone.