#78 · Briefing · 10/2/2026

AI Shifts Vulnerability Discovery

A newly discovered AI agent just autonomously uncovered a critical, unauthenticated command injection flaw.

AI agent uncovers critical flaw — AI-generated illustration. AI agent uncovers critical flaw

A newly discovered AI agent just autonomously uncovered a critical, unauthenticated command injection flaw. This surge occurred as GTIG recorded 141 distinct exploited vulnerabilities in those first eight months, surpassing the 127 tracked throughout 2025.

Half of these vulnerabilities identified as likely discovered by AI result in remote code execution, compared to just 26% found by other means. Of these AI-discovered flaws, 39% were rated Low Risk and 58% Medium Risk, compared to 69% Low and 28% Medium for non-AI flaws. Zero-day exploitation also experienced a minor increase, rising from a monthly average of 8 in 2025 to 11 in 2026.

However, despite these rising numbers, only 0.23% of all disclosed vulnerabilities in 2026 were actually observed exploited in the wild. The higher severity of AI-discovered flaws likely reflects how research programs deploy AI agents to audit critical infrastructure and sensitive privilege boundaries. One thing remains unclear. The risk classifications (Low, Medium, High) cited in the report are based on GTIG's proprietary threat-risk ratings, which differ from the industry-standard Common Vulnerability Scoring System (CVSS) severity scores.

The risk classifications (Low, Medium, High) cited in the report are based on GTIG's proprietary threat-risk ratings, which differ from the industry-standard Common Vulnerability Scoring System (CVSS) severity scores.

Read the original reporting: https://www.helpnetsecurity.com/2026/10/01/vulnerabilities-ai-finds/

Sources

Help Net SecurityPage not found - Help Net Security
Google CloudVulnerability Discovery and Exploitation Trends in the AI Era
Help Net SecurityThe vulnerabilities AI finds are the ones attackers want
SecurityWeekGoogle: AI Is Changing the Pace and Profile of Vulnerability Discovery
The RecordGoogle: Vulnerability disclosures double to 10,000 per month as AI fuels exploitation
Infosecurity MagazineAI-Found Vulnerabilities More Likely to Enable RCE, Google Says

Verified claims

disputedMonthly CVE disclosures doubled in 2026, rising from 5,045 in January to 10,740 in August.

disputedThe average number of vulnerabilities exploited in the wild rose from 10.5 per month in 2025 to 18 per month between January and August 2026.

disputedGTIG recorded 141 distinct exploited vulnerabilities in the first eight months of 2026, surpassing the 127 exploited in all of 2025.

disputedOnly 0.23% of disclosed vulnerabilities in 2026 were observed exploited in the wild.

disputedZero-day exploitation grew slightly, from an average of 8 per month in 2025 to 11 per month in 2026.

disputedHalf of the vulnerabilities identified as likely discovered by AI result in remote code execution, compared to 26% of those found by other means.

disputedOf the AI-discovered vulnerabilities, 39% were rated Low Risk and 58% Medium Risk, compared to 69% Low Risk and 28% Medium Risk for non-AI flaws.

disputedThe higher severity of AI-discovered flaws likely reflects how research programs deploy AI agents to audit critical infrastructure and sensitive privilege boundaries.

disputedThreat actors are likely using LLMs and AI tools to automate the analysis of patches, announcements, and proof-of-concept code to rapidly weaponize n-days.

disputedThe unauthenticated command injection vulnerability CVE-2026-1731 was discovered autonomously by the Hacktron AI research agent.

disputedA threat cluster exploited CVE-2026-1731 within four days of public disclosure, and five more clusters exploited it within seven days.

disputedKelli Vanderlee, senior analyst at GTIG, stated that AI-assisted vulnerability discovery and exploitation are expected to continue growing in the short-to-medium term.

Original reporting: https://www.helpnetsecurity.com/2026/10/01/vulnerabilities-ai-finds/

Written by The Quiet Search. Method: /about.

Related

Comments

Plain text only. New comments stay hidden until a person reviews them.