Forget the AI Slowdown—the Vulnerability Explosion Is Already Happening

The rate at which software vulnerabilities are being discovered has more than doubled, outstripping the pace of human remediation. This means more flaws are likely to remain unpatched for longer, increasing your risk exposure.

The cybersecurity landscape is experiencing an unprecedented surge in reported software vulnerabilities, largely attributed to the accelerated discovery capabilities of mainstream AI tools. This trend has intensified in recent months, overwhelming understaffed IT and security teams and straining open-source software maintainers. Microsoft reported patching 974 CVEs in a single month, a new record, while Oracle shipped 1,448 patches in July, a significant increase from the previous year. Google Chrome’s releases in June alone included 1,072 patches, surpassing the combined fixes from the prior 23 major versions. Mozilla also noted finding 271 vulnerabilities in Firefox using an AI model. Cumulatively, over 66,401 CVEs have been recorded this year, nearly double the number by the same date last year. Experts are divided on whether this rise in known vulnerabilities will lead to a security crisis or simply magnify existing challenges, but the pace of discovery is clearly outstripping the capacity for remediation.

The current explosion in disclosed vulnerabilities, fueled by AI-driven discovery tools, signals a critical inflection point for cybersecurity. While AI might be democratizing vulnerability discovery, it is simultaneously amplifying the existing bottleneck of human capacity for patching and remediation. This dynamic suggests a growing gap between known risks and the ability to address them, potentially creating a wider attack surface for malicious actors.

As AI models become more accessible and capable, the sheer volume of vulnerabilities discovered will continue to rise, straining even well-resourced organizations. The challenge for the industry is no longer about finding flaws, but about developing scalable, efficient processes for patching and mitigation. Companies that cannot adapt their security operations to this new reality will face escalating risks from sophisticated attacks leveraging these newly exposed weaknesses.