Loading story…
Researchers and security leaders at Black Hat USA 2026 warned that AI is sharply increasing the rate of software vulnerability discovery, raising concerns that defenders may struggle to keep pace with disclosure and remediation. The discussion highlighted research from Arizona State University led by Yan Shoshitaishvili, which found that AI-assisted workflows and training on characteristics of previously identified bugs significantly boosted the number of flaws uncovered.
The surge in findings is colliding with growing defensive pressure, including high recent Microsoft Patch Tuesday CVE volumes and the U.S. government's new Gold Eagle initiative to coordinate vulnerability research, mitigation, and fixes. Speakers cautioned that discovery may now be outpacing responsible disclosure and patching capacity, increasing the risk of exposed systems and hurried fixes, while also arguing that sustained AI-driven research could eventually reduce long-standing bug backlogs and improve software security overall.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
According to the article, July brought 622 vulnerabilities, including zero-days under active exploitation.
The article states that June included 571 CVEs overall, including 208 direct Microsoft CVEs, underscoring the scale of vulnerability handling demands.
A June Washington Post article cited by the source reported that Anthropic's Claude Mythos discovered 479 vulnerabilities in the Linux kernel.
The article says Microsoft's May Patch Tuesday included 118 CVEs, continuing the pattern of high vulnerability remediation volume.
The article states that Microsoft's April Patch Tuesday included 169 CVEs, cited as part of mounting defensive pressure from rising vulnerability volumes.
At Black Hat USA 2026, a keynote highlighted Arizona State University research led by Yan Shoshitaishvili showing that AI workflows and training on prior vulnerability characteristics sharply increased software flaw discovery.
After training the GPT models on properties of previously known vulnerabilities, the Arizona State University team reported discovering approximately 1,000 vulnerabilities.
Using Claude Mythos's Linux kernel results as a benchmark, Arizona State University researchers integrated similar workflows into three GPT models and increased discovery to around 600 vulnerabilities.
The article says the U.S. government created a vulnerability clearing house named Gold Eagle to coordinate vulnerability discovery, mitigation, and fixes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security teams are struggling to keep pace as AI accelerates vulnerability discovery, bug bounty submissions, and pentest findings faster than organizations can validate and remediate them. Microsoft said it paid more than **$20 million** to **562 researchers** for **2,531** eligible reports across 15 bug bounty programs, attributing a surge in submissions in part to AI-assisted research, while Cloudflare said it now uses Anthropic’s Claude Sonnet to triage bug bounty reports, filtering duplicates and routing only higher-value submissions for human review. Survey data from Pentest-Tools.com similarly found that AI-generated findings are creating large validation backlogs, with practitioners citing false positives, duplicate reports, unexploitable issues, and even fabricated CVEs as persistent problems. The operational gap is widening as attackers move faster than defenders can patch. Dataminr reported a median patch time of **43 days** versus an average attacker breakout time of **29 minutes**, and ZDNET described an ecosystem-wide surge in flaws across major vendors and open source projects, including high-volume bug discovery in Chrome, Apple platforms, and the Linux kernel. Open-source maintainers are also tightening disclosure processes under strain: GNOME reduced its disclosure deadline from **90 days** to **30 days** for new reports and said it would stop forwarding reports to projects that ban AI-generated content. Across the industry, the trend is pushing CISOs toward exploitability-based prioritization, stronger triage workflows, and selective automation rather than relying on raw finding volume alone.
Aug 5, 2026
European and national cyber authorities are warning that AI is rapidly increasing the speed and scale of vulnerability discovery and exploit development, raising the prospect of a sustained remediation crisis. The European Central Bank told about 110 major banks to assess AI-enabled cyber threats and submit action plans by **October 31, 2026**, while the European Systemic Risk Board and European Supervisory Authorities issued parallel warnings on systemic risk from frontier AI models. In France, ANSSI Director General Vincent Strubel told senators that AI-assisted discovery could create a multi-year **"patch wall"**, overwhelming remediation teams even as basic controls such as network segmentation, identity and access management, and timely patching remain the most effective defenses. Industry reporting and vendor disclosures show why regulators are escalating. Mozilla said frontier AI models helped identify **271 vulnerabilities** fixed in Firefox 150 after an earlier run found 22 security-sensitive bugs, while researchers and commentators say LLM-assisted patch diffing can shrink the path from a disclosed `CVE` to a working proof of concept to days or even hours, including for flaws such as `CVE-2025-32433` in Erlang/OTP SSH. At the same time, access controls around advanced cyber-capable models are tightening unevenly: Anthropic expanded its restricted **Project Glasswing** program for Claude Mythos to critical-infrastructure organizations, but open-weight alternatives such as Zhipu AI's **GLM-5.2** are reported to deliver competitive vulnerability-finding performance at lower cost, reinforcing concerns that powerful offensive-relevant capability is spreading faster than most enterprises can patch.
Jul 10, 2026
Security researchers and industry commentators warned that AI is rapidly accelerating patch analysis and vulnerability discovery, making it easier to extract exploit-relevant details from public fixes before many organizations can remediate. Reporting on recent research highlighted how large language models and automated patch-diffing can identify patched executables, vulnerable functions, and likely root causes from vendor updates, while Linux-focused analysis said similar techniques can infer affected components and even help reproduce proof-of-concept conditions from public patches. Examples cited include Akamai’s **PatchDiff-AI** work on Windows updates and **K-Repro** research that reproduced dozens of `KernelCTF` vulnerabilities from patch data. The coverage said defenders are struggling with incomplete vulnerability intelligence and weak automation inputs, especially when advisories lack timely, machine-readable metadata. One example involved **CVE-2026-7473** in **Arista EOS**, which was reportedly exploited in the wild but did not appear in public CVE databases for about a month after Arista published its advisory; Arista also issued configuration-based mitigations rather than a software patch, limiting the usefulness of version-only scanners. The reports argued that organizations need stronger configuration monitoring, intrusion detection, threat hunting, and better vendor support for structured advisory formats such as **CSAF** to keep pace with AI-enabled attackers.
Aug 1, 2026