02 · The Types

The mix is shifting toward the web. The classes haven't changed.

If AI were inventing new kinds of vulnerabilities, you'd expect the weakness taxonomy to churn. It hasn't. What's moved is the ranking — authorization and web-injection flaws rising, the single dominant memory-safety weakness sliding.

CWE Top 25 — how the ranks moved, 2023→2025

Selected weaknesses in MITRE's ranking. Highlighted lines are the notable movers.

Cross-Site Scripting took #1 in 2024 and held it. Missing Authorization climbed from outside the top 10 to #4. Out-of-bounds Write — #1 from 2021–2023 — slid to #5. MITRE CWE Top 25, 2023 / 2024 / 2025

Memory safety is a tale of two codebases

76% → <20%

Where memory-safe languages arrived

Google's Android memory-safety bugs fell from 76% of vulnerabilities (2019) to 24% (2024) to under 20% (2025) — by writing new code in Rust rather than rewriting old code. Vulnerability density decays as fresh code displaces old.

Google Security Blog, 2024–2025

~70%

Where they didn't

Microsoft and Chromium still report ~70% of their serious bugs as memory-safety issues. The trend is bifurcating — falling fast in memory-safe-language shops, flat everywhere legacy C/C++ persists.

CISA / Google, memory-safety roadmaps

Do AI tools find different bugs? They split by paradigm.

AI-found bugs split by tool paradigm. LLM web/app pentesters (XBOW) skew to the injection/web surface — RCE, SQLi, XXE, SSRF, XSS. Code-reasoning / variant-analysis tools (Big Sleep) reach memory-safety bugs fuzzing missed — the SQLite stack overflow, 12 OpenSSL vulns. Autonomous end-to-end systems (AIxCC) span both C and Java, memory-safety and injection. Cross-cutting: both paradigms only produced reliable results once a deterministic NON-LLM verifier was bolted on — unsupervised LLM 'finds' over-report plausible-but-false web-class issues.

Google Project Zero / DARPA AIxCC / XBOW

The honest caveat on this whole section

No single public dataset shows "share of all vulnerabilities by class over time." The CWE Top 25 ranks CVE-prevalence × severity, which over-weights the high-volume web ecosystem. And 2025's new buffer-overflow entries are partly a MITRE taxonomy re-split, not a real memory-bug resurgence. The type mix is stable as far as the data shows — but the data is coarser than the confident takes assume.