AI Tools Are Flooding the Internet With Security Vulnerabilities

The cybersecurity world is experiencing a shock to its system. Artificial intelligence tools have become so effective at finding software vulnerabilities that the sheer volume of discoveries is starting to overwhelm the human teams responsible for fixing them. This isn’t a theoretical concern anymore; it’s happening right now, and it’s forcing security experts to rethink how we actually protect ourselves online.

The numbers tell a stark story. Microsoft announced a record-breaking 974 patches just this month. Oracle shipped 1,448 patches in July alone, compared to just 309 in the same month last year. Google Chrome released 1,072 patches across two major versions in June, exceeding the total patches from the previous 23 releases combined. Mozilla discovered 271 vulnerabilities in Firefox during a single bug-hunting sprint using Anthropic’s AI model.

As of mid-September, the CVE (common vulnerabilities and exposures) database had logged 66,401 confirmed software flaws. By the same date last year, that number was barely 33,512. For context, all of 2022 saw just 25,000 CVEs recorded.

The Patch Apocalypse Problem

Here’s where things get genuinely concerning. Finding vulnerabilities is only half the battle. Someone actually has to patch them. And that’s where the system starts to crack.

Jerry Gamblin, head of research at Empirical Security, puts it perfectly: “Discovery scales with compute. Remediation scales with people, and people are the part you can’t buy more of in a quarter.”

AI can discover thousands of bugs in minutes. Developers, however, need time to understand each vulnerability, write and test fixes, and coordinate releases. The bottleneck is entirely human. When vulnerability discovery accelerates faster than developers can possibly respond, attackers get a growing window of opportunity. They’ll use the same AI tools to find exploits before patches are even available.

Britain’s National Cyber Security Center cuts to the heart of the paradox: “Just finding vulnerabilities does nothing to improve your security.” More knowledge about weaknesses only helps if you can actually fix them faster than bad actors can exploit them.

Who’s Winning, Really?

The cybersecurity community remains divided about whether this represents genuine catastrophe or just an amplification of existing problems. Some researchers point out that poor patch adoption and chronically underfunded security operations already handed attackers massive advantages. AI might simply be making obvious problems impossible to ignore.

Matthew Olney, director of threat intelligence at Cisco Systems, offers a more nuanced view: both defenders and attackers are still figuring out where AI creates real value. “Actors, just like industry, are trying to figure out, ‘where do I use AI?’” There’s currently a tenuous balance between AI accelerating bug discovery and AI helping defenders respond.

But that balance feels fragile.

The Vulnerability Tsunami Already Arrived

Here’s the uncomfortable truth: even if AI leaders manage to negotiate some kind of industry slowdown on frontier AI development, it won’t stop what’s already happening. The tech industry has already deployed widely available AI models capable of supercharging vulnerability research. That capability exists in open-weight models anyone can download. The vulnerability tsunami isn’t a future threat; it’s here.

While some worry about catastrophic AI misuse years from now, security teams are drowning in the immediate consequences. Under-resourced IT departments and volunteers maintaining critical open-source software are getting crushed under the weight of disclosures. There’s simply no way to absorb this rate of vulnerability information without fundamental changes to how we approach software maintenance and deployment.

The question isn’t whether we’ll see more vulnerabilities discovered by AI. The question is whether our systems for responding to them can possibly keep up, and what happens when they inevitably can’t.

Source: Kernel Panic, WIRED