AI-assisted security research is uncovering software flaws at a pace that human teams may struggle to absorb. WIRED reports a sharp rise in recorded vulnerabilities and patch volumes, turning a theoretical debate about AI-enabled hacking into an immediate operational problem for developers, defenders and open-source maintainers.
The increase does not mean every newly catalogued flaw was created by AI or that software suddenly became twice as insecure. It does show that automated discovery can expose weaknesses much faster than organizations can assess, repair and deploy fixes.
Patch Volumes Have Reached Unusual Levels
Microsoft said it issued patches for 974 common vulnerabilities and exposures during the month covered by WIRED’s report, a company record. Oracle shipped 1,448 patches in July, compared with 309 in July 2025. Two major Google Chrome releases in June contained 1,072 fixes, more than the combined total in the preceding 23 major releases.
Mozilla provided a particularly direct example of AI-assisted discovery. It said a bug-hunting sprint using Anthropic’s Mythos model found 271 Firefox vulnerabilities in April.
The wider CVE database reflects the same acceleration. Jerry Gamblin, head of research at Empirical Security and founder of the cve.icu analysis project, counted 66,401 recorded vulnerabilities by September 16. At the same point in the previous year, the project had logged 33,512. It recorded about 25,000 for all of 2022.
Those figures combine flaws found through many methods, so they cannot by themselves measure AI’s contribution. WIRED’s evidence supports an acceleration in discovery, not a claim that every increase was caused by a model.
Discovery Helps Defenders but Expands the Queue
More known vulnerabilities can be a sign that security processes are working. Gamblin cautioned that a larger CVE total is not the same as more underlying vulnerability; it means more weaknesses are visible and can potentially be fixed.
The difficulty is what happens after discovery. Developers must reproduce a flaw, evaluate its severity, design a safe patch, test for regressions and distribute an update. Users then have to install it. Open-source projects may depend on volunteers, while corporate security teams already operate with limited time and staff.
Britain’s National Cyber Security Centre summarized the constraint by observing that finding vulnerabilities alone does not improve security. The warning matters because disclosure can create a race. Maintainers gain information needed for repairs, but attackers may also learn where to look, and AI tools can help more people search for related weaknesses.
Matthew Olney, Cisco’s director of threat intelligence, said both defenders and threat actors are still working out where AI is useful. WIRED describes the current balance as tenuous rather than decisively tilted toward either side.
Remediation Is the Human Bottleneck
The central risk is a mismatch between scalable discovery and labor-intensive repair. Models can run repeated tests across large codebases, while remediation still depends on people with the context to understand the software and the authority to change it. Gamblin put the distinction plainly: discovery scales with compute, whereas remediation scales with people.
That mismatch could produce longer queues of disclosed but unpatched flaws. It could also widen the gap between vendors able to fund large security programs and smaller maintainers responsible for widely used components. WIRED does not quantify how many of the newly found issues remain exploitable or how quickly average patch times have changed, so the scale of downstream harm remains uncertain.
Proposals to slow frontier AI development would not remove this pressure. The tools already available—including open-weight models and mainstream chatbots—can assist vulnerability research now. The practical question is therefore no longer whether AI will alter bug discovery, but whether patch development, deployment and adoption can be reorganized to keep pace with a much faster flow of findings.
