AI doomers have shifted their focus from a software vulnerability apocalypse to fears of rogue AI causing mass human deaths within the next decade. But while AI leaders debate a cooperative slowdown on frontier model development, one part of the cybersecurity shift is already here, driven by capabilities in mainstream AI products, including open weight models.

A surge of vulnerabilities found using AI has accelerated in recent months, straining under-resourced IT and security teams and the volunteers who maintain critical open source software. Microsoft said last week it issued patches for 974 CVEs this month, a new record. In July, Oracle shipped 1,448 patches, up from 309 in July 2025. Google Chrome's two major June releases included 1,072 patches, more than all fixes in the prior 23 big releases combined. Mozilla said in April it found 271 vulnerabilities in Firefox during one bug-hunting sprint using Anthropic's Mythos model.

According to Jerry Gamblin, head of research at Empirical Security and founder of RogoLabs, which runs the CVE analysis project cve.icu, 66,401 CVEs have been recorded as of Wednesday this week. By September 16 last year, cve.icu had logged 33,512 CVEs for the year, almost half the current total. For all of 2022, the year OpenAI launched its first ChatGPT, cve.icu recorded 25,000 CVEs.

Researchers remain divided on whether the spike will be catastrophic or simply magnify existing challenges. Gamblin says the explosion isn't overblown, but pushes back on the idea that a bigger number is itself the harm. "More CVEs is not more vulnerability. It's more known vulnerability, which is mostly the system working," he says. The fear is that discovery will outpace patching, leaving users unable to keep up and fueling escalating attacks. As Britain's National Cyber Security Center puts it, "Just finding vulnerabilities does nothing to improve your security."

For now, researchers describe a tenuous balance between AI accelerating bug discovery and AI aiding defenders. "Actors, just like industry, are trying to figure out, 'where do I use AI?'" says Matthew Olney, director of threat intelligence at Cisco Systems. An AI slowdown, whether through regulation or industry accord, might prevent a mass extermination event, but it cannot stop the vulnerability tsunami already unleashed by existing AI tools. As Gamblin puts it, "Discovery scales with compute. Remediation scales with people-and people are the part you can't buy more of in a quarter."

Source: Wired