Artificial Intelligence is Finding Twice as Many Software Vulnerabilities
Despite a sharp increase in the scale of finding bugs and vulnerabilities in software code using artificial intelligence tools, this situation has not led to an intensification of cyberattack waves. According to ixbt.com, an analysis by VulnCheck showed that only 1.4% (14 out of 1,061) of the vulnerabilities identified with AI involvement were exploited by real criminals. This figure does not differ from statistics on traditional bugs found through other methods. This is reported by Ixbt.com reports .
Recently, the rate of recording software flaws has accelerated unprecedentedly. The US National Vulnerability Database (NVD) registered 45,207 software vulnerabilities between January 1 and July 27, 2026. This figure is almost equal to the record annual result of 2025. If the current pace continues, by the end of the year this figure could be twice as high as last year's.
Growth of vulnerabilities in major technology companies
Leading tech giants have also become more active in fixing bugs in their products. Microsoft closed a record 622 issues and specifically noted that AI tools played a key role in finding them. Meanwhile, Oracle fixed 1,449 vulnerabilities in its July update, whereas in the same period last year this figure was 309.Nevertheless, VulnCheck's analysis confirms that the total increase in bugs does not lead to a proportional growth in the number of attacks. Although the number of CVE records increased by 45% in the first half of 2026, the share of vulnerabilities used in actual cyberattacks grew by only 10%. Overall, the share of CVEs used by cybercriminals has decreased to 1.4%.
Anthropic project and developers' achievements
Researchers also studied the results of the Glasswing project, which utilized Anthropic's Claude system. Although it was announced in May that Claude identified over 23,000 potential issues, only a very small fraction of them were assigned CVE identifiers, and just 1 vulnerability was confirmed in real attacks. According to experts, growth indicators do not signify expanded hacker capabilities, but rather indicate that developers are more effectively searching for bugs in their own software.Vulnerabilities discovered and patched on time by manufacturers prevent them from falling into the hands of cybercriminals. However, risks have not completely disappeared. The average time from vulnerability publication to its first exploitation decreased from 120 days in 2025 to 80 days in the first half of 2026.
Comments 0
…