AI-driven vulnerability discovery outruns patching as exploits precede fixes

Discovery has shifted to AI speed

An analysis published on dev.to argues that security's oldest constraint — the sheer difficulty of finding bugs — is collapsing under AI. Modern models can now sift through large codebases, reason about how weaknesses chain together into attack paths, and help reproduce and even fix flaws, compressing work that once took researchers days or weeks.

The figures the post points to are striking. By mid-September 2026, more than 66,000 CVEs had reportedly been recorded, a pace the author says is more than double that of 2025. Oracle's July 2026 Critical Patch Update was its largest security release ever, spanning 1,449 patches, 1,434 distinct CVEs and 334 products — and, according to the post, Oracle itself credited part of the increase to AI-powered identification of actionable findings.

Patching still runs on human time

The article's central claim is that discovery and remediation have decoupled. Once an AI flags a flaw, engineers still have to confirm it, understand the affected code, design a fix, check backward compatibility, write tests, get the patch reviewed, deploy it safely and monitor production — work measured in hours, days or longer. Automated detection is now feeding a human-paced repair queue.

The post frames the consequence as simple backlog arithmetic: a team sitting on 50 known vulnerabilities with the capacity to properly fix ten a month can watch that queue swell to hundreds or a thousand once AI-assisted scanning multiplies the inflow. The result, in the author's telling, is a pile of known-but-unfixed flaws that compounds faster than teams can shrink it.

Attackers get the same advantage

The tools are not exclusive to defenders. The post cites Google Cloud warnings that attackers can likewise use increasingly capable models to find and exploit vulnerabilities, and points to Microsoft's 2026 Secure Future Initiative report, which reportedly states that frontier models help attackers discover flaws, chain attack paths and scale exploitation beyond what manual methods allow. The decisive question is no longer whether a vulnerability can be found, but who finds it first and who acts faster.

Exploitation is starting before patches exist

The most consequential data point in the analysis comes from Google's Mandiant team, whose 2026 figures reportedly show a mean time-to-exploit of minus seven days — meaning vulnerabilities are, on average, being exploited in the wild before a patch is even available. The window between disclosure and active exploitation that defenders once relied on is effectively gone in many cases, and the post argues it may keep shrinking.

Volume demands ruthless prioritization

When findings multiply, treating every CVE equally stops working. A CVSS score alone, the author argues, says little about real-world risk. Teams need to ask whether a flaw is internet-facing, whether it is genuinely exploitable rather than theoretical, what privileges an attacker needs, what data is exposed, and — above all — whether there is evidence of active exploitation. The goal shifts from patching the largest number of things to reducing the largest amount of actual risk soonest.

AI has to help fix, not just find

The proposed way out is automated remediation. The post highlights Google's recently released open-source Mantis system, which is designed to handle the chain from discovery through triage, reproduction and patching, combining agentic techniques with sandboxed reproduction so that findings are verified rather than taken on a model's word. That verification layer matters: according to Google remarks cited in the post, careless AI scanning can produce extremely weak true-positive rates. The workable pipeline is AI proposing candidates, tooling validating them, tests confirming the fix and humans reviewing it before anything ships.

Why it matters

The economics of software security have inverted. Detection is becoming cheap and abundant while remediation remains scarce and slow, and the same models accelerating defense are also accelerating offense — with Mandiant's negative time-to-exploit suggesting attackers are already winning the timing race in some cases. Organizations that respond with headcount alone will drown in backlog; those that invest in exploitability-based triage, automated verification and AI-assisted patching can convert the flood of findings into faster risk reduction. There is also a measurement trap to avoid: soaring CVE counts may signal better scanners surfacing long-standing bugs rather than suddenly worse code — but every newly exposed flaw still has to be fixed by someone.