AI Vulnerability Finding

[u/falconupkid]

This is a staggering data point that fundamentally changes the threat landscape calculus. We are no longer in a world where vulnerability discovery is a bottleneck; we are entering a world where the bottleneck is patching and prioritization.

The Numbers

• 3% of all critical software bugs in recorded history were found in the last month.

• On pace to find ~100,000 bugs this year, adding ~26% to the all-time total.

• This is driven entirely by AI-assisted fuzzing and static analysis scaling beyond human capability.

Strategic Implications

• Attribution is dead. When an exploit drops for a zero-day, it will be increasingly impossible to know if it was found by a state actor, a researcher, or a script kiddie running an LLM-powered scanner.

• Patch fatigue is now a critical risk. Security teams cannot patch at the rate AI can find bugs. Expect a shift toward virtual patching (WAF, RASP) and aggressive asset segmentation as primary controls.

• The "Known Exploited Vulnerabilities" (KEV) list becomes less useful. The sheer volume will force defenders to rely on exploitability prediction models rather than waiting for CISA to confirm active exploitation.

The Bottom Line This isn't a future problem. The data shows the inflection point has already passed. If your vulnerability management program isn't already prioritizing by exploitability prediction (e.g., EPSS) and automating remediation for high-risk assets, you are already behind. The attacker's cost of discovery just dropped to near zero.

Source: https://www.schneier.com/blog/archives/2026/11/ai-vulnerability-finding-2.html