MITRE CVE Record Shows AI Finding Security Flaws Faster Than Teams Can Triage Them

MITRE logged a record 48,244 vulnerabilities in 2025, and the MITRE CVE record kept climbing during the first half of 2026. AI-assisted research helped uncover flaws faster, but disclosure volume is now growing beyond many security teams’ capacity to verify, prioritize, and patch each finding.

More than 35,000 vulnerabilities had been registered by June 2026, according to reported totals. That already represented nearly three quarters of the previous full-year record. The growth is not simply evidence that developers suddenly started writing much worse software.

The deeper shift is in discovery. AI systems can inspect large codebases, compare software versions, propose attack paths, and surface suspicious behavior at a scale human researchers cannot match. Anthropic, OpenAI, Google, Microsoft, and security vendors have all invested in cyber-focused models or research programs.

That creates a sharp tension. Finding hidden weaknesses earlier gives defenders time to remove them. Yet every new disclosure also enters an overstretched system of maintainers, coordinators, security teams, and asset owners.

The result is not a straightforward explosion in successful attacks. Available evidence shows a disclosure surge, a smaller increase in observed exploitation, and a widening operational gap between the two.

The MITRE CVE Record Is Rising Faster Than Forecasts

The defining change is not one spectacular vulnerability. It is the sustained acceleration of the entire disclosure system.

A Common Vulnerabilities and Exposures identifier, or CVE, is a standardized label for a publicly disclosed security flaw. CVEs let vendors, researchers, governments, and security tools refer to the same issue without relying on inconsistent names.

The number of registered cases remained in the tens of thousands annually between 2017 and 2020. It reached 20,161 in 2021, then rose to 40,077 in 2024 and 48,244 in 2025. More than 35,000 had already been registered by June 2026.

The Forum of Incident Response and Security Teams, known as FIRST, expected another record before the year began. Its February forecast placed the median estimate for 2026 at 59,427 CVEs.

Actual disclosures quickly moved beyond that path. FIRST’s midyear forecast found that publication volume through April was 46.3 percent above its earlier projection. The organization raised its full-year estimate to approximately 66,000 CVEs.

That reassessment identified 6,420 more CVEs than the initial model expected through April. It attributed the difference to several forces, including AI-assisted discovery, broader reporting, and changes inside the CVE ecosystem.

GitHub Security Advisory volume had increased 449 percent year over year. Activity from VulnCheck’s CNA of Last Resort had risen 3,119 percent as the organization processed a large backlog of vulnerabilities without another assigning authority.

Those details matter because the MITRE CVE record does not measure one thing. It combines new research, older findings entering the system, vendor disclosure cycles, expanded coverage, and administrative changes. Treating every additional CVE as evidence of newly insecure software would misread the data.

The number of software products represented in vulnerability tracking has also expanded substantially. Security researchers now inspect more applications, devices, libraries, cloud services, and open-source components. Better visibility naturally reveals flaws that previously remained undocumented.

Large vendor releases can produce abrupt monthly spikes. A company might disclose hundreds of related issues together after completing a coordinated review. The resulting chart reflects the publication schedule as well as the underlying discovery rate.

However, those qualifications do not erase the change. AI is widening the amount of code researchers can examine and shortening the time needed to identify plausible weaknesses. That new capacity is arriving while the reporting infrastructure already faces a growing workload.

The record therefore measures both progress and pressure. More flaws are becoming visible before attackers find them, but every valid report creates work for maintainers and defenders.

AI Vulnerability Discovery Has Changed the Scale of Bug Hunting

AI vulnerability discovery turns code review from a scarce manual activity into a process that can run repeatedly across enormous software estates.

Traditional vulnerability research requires specialists to understand an application, identify dangerous behavior, construct tests, and confirm whether an attack is practical. Automated scanners help, but they often rely on known patterns and produce false positives.

Frontier AI models add another layer. They can reason across files, trace data through a program, compare patched and unpatched versions, generate test cases, and suggest combinations of weaknesses. Human researchers still need to validate consequential findings, but the search stage can cover more ground.

Anthropic’s Claude Mythos Preview became a prominent example in 2026. The company said it began using an early model snapshot in February to examine open-source software. External security firms then helped triage, validate, and report high-severity or critical findings.

Anthropic’s public disclosure dashboard recorded 462 issued identifiers in an August snapshot. These included 177 CVE records and 285 GitHub Security Advisories, although one finding could receive both identifiers.

The broader claims were much larger. Anthropic said Project Glasswing had found more than 10,000 high-severity or critical vulnerabilities. Public records covered only a portion of that reported total, leaving researchers unable to evaluate most individual findings.

Epoch AI examined disclosure data from 21 major technology organizations, including Microsoft, Google, Apple, Oracle, Cisco, Linux, Mozilla, and Apache. Its severity data showed about 1,550 high-severity and critical CVEs published in June.

That June total exceeded three times the monthly record observed before Anthropic announced Mythos Preview. July reached approximately 2,500 high-severity and critical disclosures, about five times the earlier record.

Epoch cautioned that the figures cover public disclosures, not every privately discovered flaw. It also noted that severity ratings change as records receive new information. Historical monthly totals can move after analysts revise individual CVEs.

The timing nevertheless supports the conclusion that frontier models have become meaningful research tools. AI programs began operating alongside expanded internal audits, new disclosure initiatives, and greater investment by large vendors.

Google described its own recent discovery volume as unprecedented in scale and speed. Vendor data indicated that many newly reported flaws came from internal research rather than external attackers. That distinction gives defenders an opportunity to patch weaknesses before criminal groups weaponize them.

AI also helps researchers revisit old software. Legacy code can contain errors that survived years of testing because nobody had enough time to examine every path. A model that continuously searches for suspicious behavior can uncover vulnerabilities unrelated to recent development.

This advantage extends beyond major technology companies. Open-source maintainers, smaller vendors, and security consultancies can use automated analysis to inspect components that previously received limited attention.

Yet discovery is only the first step. A plausible flaw must be reproduced, assessed, reported securely, assigned an identifier, fixed, tested, and deployed. AI accelerates the beginning of that chain without automatically expanding every team at the end.

That imbalance explains why more discoveries do not instantly produce safer systems. The benefit depends on whether maintainers can convert findings into reliable fixes before attackers convert them into exploits.

More Disclosures Do Not Mean Every Flaw Is an Emergency

The central cybersecurity problem has shifted from finding enough vulnerabilities to identifying which findings create immediate, reachable risk.

The raw MITRE CVE record is a count, not a priority queue. A vulnerability in an internet-facing gateway with active exploitation deserves a different response from a local flaw in an unused component.

FIRST examined this distinction through exploitability data. Its midyear assessment filtered vulnerabilities using the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog and Exploit Prediction Scoring System results above 10 percent.

The organization found that actionable exploitability remained broadly flat despite the surge in total volume. In its terminology, defenders were facing more rain, but not necessarily a proportionally larger flood.

That finding challenges a common interpretation of AI vulnerability discovery. Models are clearly helping researchers produce more findings. Current evidence does not show that every AI-found weakness becomes easier or more attractive to exploit.

VulnCheck analyzed 1,061 publicly attributed AI-assisted discoveries connected to Anthropic’s Project Glasswing and the Berkeley Vulnerability Research Initiative. It found that 14, or 1.3 percent, had been confirmed as exploited in the wild.

That rate was close to the exploitation rate across VulnCheck’s wider dataset. The comparison suggests that AI-assisted discoveries were not inherently more likely to become real attacks than conventionally discovered vulnerabilities.

The gap is even clearer in Anthropic’s published results. VulnCheck reported that Claude Mythos had identified 23,019 vulnerability candidates, while only 126 had appeared as CVEs in its analysis. One had been confirmed as exploited.

These figures do not prove that the remaining candidates were harmless. Many could still be under review, undergoing coordinated disclosure, awaiting patches, or withheld because publication would create risk. They do show that candidate counts and validated CVEs are not interchangeable.

Google Threat Intelligence Group reached a related conclusion from a different dataset. Its exploitation analysis recorded 141 vulnerabilities that were both disclosed and exploited between January and August 2026.

That total exceeded the 127 recorded throughout 2025. Average monthly exploitation rose from 10.5 cases in 2025 to 18 in 2026.

However, only 0.23 percent of all disclosed 2026 vulnerabilities appeared in observed exploitation. That represented roughly one actively exploited vulnerability for every 431 disclosures.

The small percentage should not encourage complacency. A single vulnerability can affect thousands of organizations, especially when it sits in a widely deployed internet-facing product. Attackers do not need to weaponize every CVE to cause extensive damage.

The exploitation data also became more concerning later in the year. Google found that disclosure growth and exploitation growth tracked each other closely after May. Indexed disclosure volume rose 128 percent, while indexed exploitation increased 127 percent.

High-risk exploitation more than doubled. Google counted 75 exploited high-risk vulnerabilities from January through August 2026, compared with 28 throughout 2025.

Zero-day activity remained more stable. A zero-day is a vulnerability exploited before the vendor or users have an effective fix. The monthly average increased from eight during 2025 to 11 in 2026, although August reached 22.

Google suggested that attackers might gain more immediate value from rapidly weaponizing known flaws, called n-days, than from using AI to discover entirely new zero-days. Models can compare patches, release notes, product versions, and proof-of-concept code to accelerate that process.

This is why security teams need risk context, not just larger vulnerability lists. CISA’s exploited catalog identifies flaws with evidence of active exploitation. EPSS estimates the probability that a published CVE will be exploited soon.

Those signals are imperfect, but they help organizations distinguish between documented weaknesses and urgent attack paths. Asset exposure, privileges, reachable systems, and available mitigations remain essential parts of that decision.

The Real Bottleneck Is Triage and Patching Capacity

AI can produce security findings faster than organizations can determine ownership, test fixes, and deploy patches safely.

Every valid vulnerability starts an operational process. A maintainer must reproduce the issue, judge its severity, identify affected versions, create a fix, test for regressions, prepare an advisory, and coordinate publication.

Customers then face their own chain. They must locate the affected product, understand whether a vulnerable feature is active, evaluate compensating controls, schedule an update, and confirm that the patch succeeded.

This work becomes difficult when an organization lacks an accurate software inventory. A security team cannot prioritize a vulnerability confidently if it does not know where the affected component runs or which business services depend on it.

Third-party dependencies make the problem harder. A vulnerable library might sit several layers below an application and remain invisible to its operator. Containers, plugins, firmware, and managed services can obscure ownership further.

Labor shortages intensify the pressure. Yukimi Sota of Proofpoint’s Japanese branch told the original news service that many companies were falling behind on countermeasures because the security industry lacked enough workers.

Recent unauthorized access and information leaks at Japanese companies gave the record additional urgency. The incidents reportedly included Times Car, a major car-sharing service, and prompted the Japanese government to urge businesses to strengthen their defenses.

The immediate risk is not that every new CVE requires an emergency deployment. The risk is that an unstructured queue causes teams to miss the small number of flaws attackers are already exploiting.

Patching everything in publication order would waste scarce time. It could also introduce outages when rushed changes affect complex production systems. Defenders must combine threat intelligence with their own asset and business context.

A practical priority sequence starts with active exploitation. Teams should then consider internet exposure, authentication requirements, attack complexity, privileges gained, data sensitivity, and the importance of the affected service.

Vendor severity alone cannot answer those questions. A critical vulnerability in an isolated test system can present less immediate danger than a high-severity flaw on a public gateway.

Security teams also need a reliable way to preserve decisions. Advisories, exception records, affected-system notes, and mitigation evidence often become scattered across tickets, chats, spreadsheets, and email.

A searchable technical knowledge base can help teams connect vulnerability notices with architecture documents and prior remediation work. It does not replace scanning or patching, but it reduces repeated investigation.

AI can assist at this stage too. A model can summarize advisories, map product names to inventories, compare versions, draft remediation instructions, and help analysts cluster duplicate reports.

Those uses require controls. Security teams must verify generated conclusions, protect confidential system information, and avoid sending credentials or sensitive architecture details to unauthorized services.

Automated fixes create a separate risk. A patch that removes one vulnerable code path might introduce another defect or break production behavior. Maintainers still need tests, review, and staged deployment.

The pressure falls unevenly across the software ecosystem. Large vendors can operate dedicated product security teams and coordinate mass disclosure cycles. Small open-source projects might depend on a few volunteers handling thousands of users.

AI-assisted research can therefore move costs from well-funded model developers and security laboratories to maintainers with limited resources. Finding more bugs is valuable, but disclosure programs must account for the receiver’s ability to respond.

Responsible reporting needs deduplication, clear reproduction steps, severity evidence, and reasonable remediation windows. Submitting thousands of low-confidence alerts would consume attention without producing equivalent security gains.

The strongest outcome is a balanced pipeline. AI searches broadly, humans validate consequential findings, maintainers receive useful reports, and defenders rank deployment by real exposure.

Without that discipline, higher discovery volume becomes another source of alert fatigue. Teams see more warnings while the most dangerous few remain buried.

AI Changes Both Sides of the Vulnerability Race

The strategic contest is not AI defenders against traditional attackers. Both sides can use similar capabilities at different stages of the same vulnerability lifecycle.

Defenders currently gain a meaningful advantage when internal AI programs find and fix flaws before publication. Google reported that 401 of 433 Chrome vulnerabilities in one large update were found internally.

That pattern suggests the disclosure surge includes preventative work. A vendor-controlled discovery allows engineers to develop a patch, coordinate its release, and prepare customers before detailed technical information spreads.

Attackers gain leverage after disclosure. AI can digest an advisory, compare code changes, generate a proof of concept, scan for exposed systems, and adapt public exploit code. These activities compress the period between publication and attempted exploitation.

Recorded Future said the average time needed for attackers to exploit vulnerabilities fell from 72 hours in 2025 to 24 hours in 2026. That estimate reinforces the need to prioritize reachable flaws immediately, even though most CVEs never appear in observed attacks.

AI systems might eventually discover and exploit unknown flaws autonomously. Public cases and vendor claims show progress toward longer chains of cybersecurity work, but the available evidence remains uneven.

Some demonstrations occur in controlled environments with carefully selected targets, extensive computing resources, custom instructions, and expert supervision. Their results do not establish that ordinary criminals can reproduce the same performance at scale.

Palo Alto Networks said advanced models from Anthropic and OpenAI helped it find 75 vulnerabilities in its products, more than seven times its usual monthly count. Its chief product officer also acknowledged that the effort required substantial customization and human expertise.

That qualification is important. Model capability is only one part of an operational attack. Adversaries still need target access, infrastructure, validation, stealth, persistence, and a way to turn technical access into a useful outcome.

Defenders hold structural advantages as well. Vendors control source code, internal tests, product telemetry, and patch distribution. They can direct models toward their own systems and validate results with engineers who understand the architecture.

Attackers benefit from asymmetry. They only need one useful path into a target, while defenders must manage every important system. AI does not create that imbalance, but faster research can intensify it.

Disclosure itself links the two sides. Publishing a CVE gives defenders a shared identifier and remediation information. It can also tell attackers where to focus, particularly when a patch reveals the vulnerable code.

Delaying disclosure indefinitely is not a solution. Unreported flaws can remain exploitable without giving customers any path to protection. The goal is coordination that gives maintainers time to release a fix while limiting unnecessary technical exposure.

The strongest evidence so far supports a narrower conclusion than either optimistic or alarmist claims. AI is already increasing vulnerability discovery capacity. It is also helping with analysis and exploit development, but exploitation has not risen in direct proportion to raw disclosures.

That balance can change. Models are improving, cyber-focused training is expanding, and more organizations are integrating agents into research workflows. Access controls around the most capable systems will influence how quickly those abilities spread.

Security leaders should avoid planning around a single dramatic prediction. They should assume that discovery and weaponization will both get faster, then build processes that remain useful across several possible timelines.

That means shorter asset-identification cycles, tested emergency patch procedures, better segmentation, and stronger monitoring for exploitation. It also means using defensive AI where its output can be checked against authoritative data.

What Security Teams Should Watch Next

Three signals will show whether the vulnerability surge remains manageable or becomes a larger exploitation crisis.

The first signal is the relationship between total CVEs and confirmed exploitation. Raw disclosure counts will probably continue setting records, but they do not determine operational risk by themselves.

Teams should track the CISA catalog, exploitation telemetry, and high-confidence probability scores. If exploited vulnerabilities remain a small fraction of disclosures, prioritization can contain much of the workload.

If exploitation begins growing faster than disclosure, the central argument changes. That would indicate attackers are converting a larger share of findings into working operations, not merely benefiting from a larger pool.

The second signal is the delay between discovery, validation, and patch availability. AI-assisted programs can claim thousands of candidates, while only a fraction appear in public advisories with fixes.

A falling conversion delay would show that vendors and coordinators are expanding capacity alongside discovery. A growing backlog would mean AI has accelerated the front of the pipeline without solving the harder remediation bottleneck.

Public ledgers should make this easier to evaluate. Useful reporting would separate candidates, validated vulnerabilities, assigned identifiers, completed patches, and deployed fixes.

The third signal is exploitation speed after a patch or advisory becomes public. Defenders once measured response windows in weeks for many vulnerabilities. Evidence of routine weaponization within one day would force more organizations to automate exposure checks and emergency remediation.

This signal matters more than spectacular laboratory demonstrations. A repeatable reduction in real-world weaponization time would affect every enterprise using common software, even if attackers never gain fully autonomous zero-day discovery.

The MITRE CVE record should therefore prompt a process review, not indiscriminate panic. Organizations need to know which systems they operate, which ones face the internet, and who owns remediation decisions.

They should also test whether urgent updates can move from advisory to deployment without becoming trapped in approval queues. Emergency procedures that exist only on paper will not match a 24-hour exploitation window.

AI vulnerability discovery remains a defensive opportunity. It can expose old weaknesses before criminals find them and help maintainers examine code that lacked sufficient review.

The benefit depends on what happens after discovery. A finding that nobody validates creates noise. A validated CVE without an available patch creates exposure. A patch that customers cannot deploy leaves the underlying risk in place.

For developers, security leaders, and technology buyers, the key question is no longer whether AI can find more flaws. The evidence says it can. The question is whether your organization can turn that flood of findings into a small, ordered list of actions before an attacker does the same.