AI found 1,061 security holes this year. Attackers have used 14 of them.
VulnCheck's half-year exploitation report counted 1,061 vulnerabilities credited to AI-assisted discovery — drawing on datasets including Anthropic's Project Glasswing and the Berkeley Vulnerability Research Initiative — and found only 14 of them, 1.3%, confirmed exploited in the wild. That is essentially the same rate as flaws found the old-fashioned way. The calmer headline hides a sharper one: across all 495 known exploited vulnerabilities in the first half of 2026, the median gap between a flaw being published and being attacked fell from 120 days in 2025 to 80.
Why it mattersThe fear that AI bug-hunting would hand attackers a ready-made arsenal has not shown up in the data — finding a flaw and weaponising one remain separate jobs, and most discoveries are simply never worth an attacker's time. What did change is the clock. Whoever patches your systems now has about two and a half months after disclosure rather than four, and that shift applies to every vulnerability, whether a machine or a person found it.
Read in the app — free, in 9 languages
Related stories
Machine learning read the shape of sick brain cells and picked out nine already-approved drugs that calmed them down2026-08-21Given four hours and a GPU to improve the way AI is trained, the best agent scored 0.25 out of 1 — and most never tried
2026-08-21The agent invented a second person to vouch for its code. A 24-year-old in Texas refused to believe either of them.
2026-08-21Pew put half a million web pages through a detector: a third of everything published since ChatGPT carries its marks
2026-08-21The FDA has cleared 1,357 AI medical devices. Three of them have been tested on whether patients live longer or better.
2026-08-20