More vulnerabilities, the same amount, or different ones?
This is the argument everyone's actually having. Three hypotheses, each tested against what the data can and can't support.
AI is finding more vulnerabilities
Raw counts are up sharply (48,185 CVEs in 2025). But the rise is dominated by CNA expansion, the Linux-kernel and WordPress firehoses, and disclosure completeness — all pre-AI structural causes. AI-found bugs are real but still a demo-scale sliver of the total (Big Sleep's dozens, AIxCC's 18). No public dataset isolates an AI-attributable increase from the confounders.
It's roughly the same — hype exceeds reality
The consensus across OpenAI, Microsoft, Google GTIG, and the UK's NCSC is remarkably stable: AI gives threat actors productivity, not novel capability. NCSC's phrase — "evolutionary, not revolutionary." Proofpoint's 2026 telemetry: "More CVEs, same playbook." The most dramatic attacker claim (Anthropic's autonomous-espionage report) drew heavy skepticism and shipped zero IOCs.
The types are changing
The weakness taxonomy is stable. Web and authorization flaws lead the counts; memory-safety declines where memory-safe languages are adopted. AI tools skew toward classes by how they work (fuzzers→memory bugs, LLM pentesters→web bugs), but they're finding known kinds of bugs faster — not new kinds.
What actually changed: the clock
The single clearest AI-era signal isn't volume or type — it's speed. Time from disclosure to exploitation has collapsed, and it now routinely goes negative (exploited before a patch exists). Mandiant and Rapid7 reach the same ~5-day figure by different methods.
Median time-to-exploit, high-severity bugs. 2026 mean is negative — exploitation precedes patch availability. Whether AI caused this is asserted by vendors, not demonstrated with controlled data. Mandiant M-Trends / Rapid7 2026
Zero-days exploited in the wild — a rising band, not a runaway
Google/Mandiant detection telemetry, self-revised annually. GTIG frames these as a "consolidating" 60–100/yr band. No AI-driven explosion is visible in the exploitation data — the growth is in disclosure, not in what attackers actually use. Mandiant / Google GTIG zero-day reviews
The evidence, dated
Defender-side milestones in teal, attacker-side in red. Confidence varies — the disputed items are marked in the sources.
The defender's ledger
- Big Sleep — Google's agent found a real SQLite 0-day fuzzing missed, then 12 OpenSSL bugs. Credible, narrow, human-reviewed.
- DARPA AIxCC — independent competition: AI found 54/63 synthetic + 18 real 0-days and auto-patched most. The strongest non-vendor proof.
- OSS-Fuzz — LLM-written fuzz harnesses found a 20-year-old OpenSSL flaw humans never reached.
The attacker's ledger
- Confirmed: Arup's $25.6M deepfake fraud; APT28's LameHug malware querying an LLM at runtime. Real, independently verified.
- Contested: Anthropic's GTG-1002 "80–90% autonomous" campaign — no IOCs, undercut by its own admissions that Claude "hallucinated credentials."
- Debunked: "First AI ransomware" (PromptLock) turned out to be an academic proof-of-concept.
Two independent checks worth holding onto
The productivity story isn't settled either. METR's randomized trial (July 2025) put 16 experienced open-source developers on 246 real tasks and found they were 19% slower with AI tools — while believing they were 20% faster. It's a snapshot, and METR itself flags later results differ, but it's a rare controlled measurement against the universal "AI makes everyone faster" assumption.
And the capability is real when an expert drives. Researcher Sean Heelan used OpenAI's o3 to find a genuine remote use-after-free zero-day in the Linux kernel's SMB implementation (CVE-2025-37899, May 2025) — independently corroborated, low-conflict. Google's John Hultquist later reported the first in-the-wild evidence of an AI-developed exploit, caught before weaponization: "probably the tip of the iceberg." An inflection, not yet scale.
What the data cannot tell us
- Whether AI has increased valid, unique vulnerability discovery net of the noise it also generates. No dataset separates the two.
- Whether AI caused the time-to-exploit collapse, or merely coincided with it. Vendors assert it; controlled evidence is absent.
- Whether any novel, AI-discovered zero-day has been used at scale in the wild. As of mid-2026, none is publicly confirmed.
- Whether the July 2026 CVE spike is a trend or an artifact. Six months isn't enough.