Google: AI Is Changing the Pace and Profile of Vulnerability Discovery

A new Google Threat Intelligence Group (GTIG) study shows that AI is reshaping both the speed and nature of vulnerability research. Comparing data from January 2025 to August 2026, GTIG found monthly disclosures more than doubled, climbing from 5,045 in January 2026 to over 10,700 by August, while in-the-wild exploitation nearly doubled too, reaching an average of 18 exploited flaws per month versus 10.5 the previous year.

GTIG notes that much of the raw disclosure growth stems from automated CVE assignment in open-source projects — Linux Kernel-related entries alone account for roughly 5,000 CVEs with no observed zero-day exploitation. More significant, the group says, is a 167% rise in high-risk disclosures and a surge in exploitation of n-day flaws, suggesting attackers are increasingly using AI to speed up patch-diffing and weaponize known bugs rather than hunt fresh zero-days.

The report also highlights that AI-discovered vulnerabilities carry a different risk profile, more often enabling remote code execution, and cites real-world exploitation of AI-found bugs such as a BeyondTrust flaw exploited within days of disclosure. Separately, GTIG tracked over 2,000 CVEs tied to AI systems themselves since 2025, with confirmed in-the-wild attacks hitting tools like LiteLLM and Langflow, underscoring growing risk across AI infrastructure.