Despite a surge in vulnerability discovery using AI‑powered tools, the expected wave of cyberattacks has not materialized. According to VulnCheck’s analysis, out of 1,061 vulnerabilities identified with the help of AI tools, only 14 cases (1.3 %) were confirmed to have been exploited by attackers. This rate is comparable to the exploitation rate for conventional vulnerabilities and is not higher.
At the same time, the pace of identifying code flaws has increased notably. According to the US National Vulnerability Database (NVD), 45,207 software vulnerabilities were recorded between January 1 and July 27, 2026. This figure is nearly equal to the record volume for the entire year of 2025, and if current trends continue, the annual total could double the previous year’s result.
This trend is also evident in the work of individual vendors. For example, in its July update, Oracle fixed 1,449 vulnerabilities — significantly more than the 309 fixes reported a year earlier. Microsoft addressed a record 622 issues and specifically highlighted the contribution of AI tools to their detection.
VulnCheck’s statistics show that the growing number of discovered vulnerabilities has not yet led to a proportional increase in attacks. In the first half of 2026, the company recorded 495 confirmed cases of vulnerability exploitation. Meanwhile, the number of published CVE entries grew by 45 % compared to previous periods, while the number of vulnerabilities actually used in attacks increased by only 10 %. As a result, the share of CVEs involved in real attacks dropped to 1.4 %; for comparison, this figure reached 2.7 % at the end of 2023.
The Glasswing project by Anthropic is particularly noteworthy — it is one of the most prominent examples of using AI to find code errors. In May, the company reported that the Claude system had identified 23,019 potential issues. However, according to VulnCheck, the public log of the project stopped growing after the initial 1,611 entries. Of these, only 126 received CVE identifiers, and just one vulnerability was confirmed to have been exploited in real attacks.
VulnCheck believes that the main reason for the rise in detected vulnerabilities is not increased attacker activity but rather the improved ability of developers themselves to find flaws in their own software. For instance, many fixes in the Chrome browser were based on Google’s internal checks rather than external reports. This, in turn, reduces risks: a vulnerability that a vendor finds and patches before publication does not become visible to attackers.
Nonetheless, the threat of faster attacks remains. The median time between a vulnerability’s publication and its first exploitation has decreased from 120 days in 2025 to 80 days in the first half of 2026. As a result, the US Cybersecurity and Infrastructure Security Agency (CISA) recommends that organizations patch critical vulnerabilities with confirmed exploitation within 3 days.
Moreover, artificial intelligence systems themselves are becoming new targets for attacks. VulnCheck has identified 28 exploitable vulnerabilities in AI systems, 10 of which have already been used by attackers. One example is a series of attacks against the LangFlow platform: through a chain of vulnerabilities, attackers gained access to credentials (including those for OpenAI and Claude services), then deployed miners and attempted to spread within the infrastructure.
Thus, at the current stage, AI significantly speeds up the discovery of software flaws but has not provided attackers with a confirmed advantage. The main effect of these tools is that developers can find and fix vulnerabilities faster — before they can be exploited.
About the Author
