And will today’s surge in AI-driven vulnerability discovery eventually make tomorrow’s software safer?
The accelerated discovery of previously unknown software vulnerabilities has been making headlines for months. It’s an issue that has even led the US government to create a vulnerability clearing house named Gold Eagle to coordinate research efforts in vulnerability discovery, mitigation, and fixes.
An indication of the broader pressure facing cyber-defenders can be drawn from the sheer number of patches being delivered in Microsoft’s Patch Tuesday through the last four months: 169 CVEs in April, 118 CVEs in May, 571 CVEs overall in June (including 208 direct Microsoft CVEs), and another 622 vulnerabilities in July that included zero-days under active exploitation.
AI Models at the Center of Vulnerability Research
A keynote at Black Hat USA 2026 detailed research by associate professor Yan Shoshitaishvili and his undergraduate students at Arizona State University on the expanding use of AI models for vulnerability discovery. Shoshitaishvili referenced a Washington Post article from June stating that Anthropic’s next-generation model Claude Mythos had discovered 479 vulnerabilities in the Linux kernel, which the university team used as a benchmark. Using previous generations of GPT models, the team had discovered around 300 flaws.
The difference was attributed to the use of workflows in Mythos, so the team set about integrating similar workflows into three GPTs, which resulted in the discovery of around 600 vulnerabilities. The team then trained the GPTs using the properties of previously known vulnerabilities and discovered approximately 1,000 vulnerabilities. They hit the barrier of discovering vulnerabilities at such speed that they could not keep pace reporting them — where reporting means detailed research and proposed fixes, rather than just identifying the issue itself. The scale calls into question the whole process of responsible disclosure, which in the team’s view was already broken, as disclosure often creates increased risk.
The Patching Problem
Patching software in a timely fashion in production environments was already a stress point for many cybersecurity teams. Exponential growth like this could be the breaking point that causes either more unpatched software and greater opportunities for cybercriminals, or patching without testing — which, in turn, could cause compatibility issues in many environments.
A Possible Peak — and a Calmer Future
Taking a logical and optimistic view of this issue, it may be that we are heading towards a peak in discovery — and that somewhere over this peak lies a period of relative stability with an improved normality. Humans researching vulnerabilities has traditionally been a resource-intensive process, producing a steady stream of discoveries that have been increasing year on year, potentially due to more researchers, more software, and more motivation through bug bounty programs and similar incentives. Switching from humans to AI represents a quantum leap in discovery, though AI is still in a learning phase: as the Arizona team demonstrated, tweaking the model and its workflow can uncover even more vulnerabilities.
There is also the matter of legacy software. Consider the enormous volume of software written over the past 30 years — no amount of human effort could possibly uncover all the vulnerabilities across the current and back catalogues. The scale of AI-assisted discovery, however, could potentially exhaust that catalogue at some stage, after which new discoveries would depend primarily on improvements to the models being used.
New software continues to be developed, of course, but logic suggests that any development team today would use the same available AI capabilities to remove potential vulnerabilities prior to releasing their software. As the models improve, the prospect of virtually flaw-free software could become a reality.
If this logic prevails, the security community may eventually reach a period of calm with very few new vulnerabilities being found — though whether that optimistic outcome materializes remains to be seen.
