AI-driven surge in discovered software vulnerabilities in 2026
AI systems designed to discover software vulnerabilities are identifying flaws at record rates in 2026, with major tech companies reporting vulnerability counts multiple times higher than 2025. While this represents a potential threat vector for malicious hackers, the number of actively exploited vulnerabilities has not yet increased.
What happened
The United States National Vulnerabilities Database recorded 45,207 security flaws between January and July 27, 2026, approaching the total number found in all of 2025, which itself was an all-time record.
Oracle patched 1,449 security vulnerabilities in its July 2026 software update versus 309 the year prior. Microsoft disclosed 642 security bugs in July 2026 versus nearly 128 in July 2025. Google found and fixed 433 bugs in a Chrome browser update versus 11 in an equivalent 2025 update.
The surge in discovered vulnerabilities is driven by increasingly capable artificial intelligence systems. At Google, the unprecedented scale and speed of vulnerability discovery is a result of advances in AI models and a corresponding investment.
Reported impact
The surge in discovered vulnerabilities lends credence to warnings governments and security firms have issued about the threat posed by hackers armed with powerful, new AI models.
However, there has been no rise in the number of exploited issues so far in 2026 despite the uptick in discovered flaws, according to the US government's Known Exploited Vulnerabilities catalog.
Index analysis
Gabriel Bernadett-Shapiro, distinguished AI research scientist at SentinelOne Inc., stated: "We have to come to the reckoning that these tools are increasing the ability of people to find vulnerabilities in software."
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.