Monthly CVE disclosures doubled in 2026, reaching 10,740 by August, according to the Google Threat Intelligence Group. High-risk vulnerabilities surged 241% in the same window. The most significant structural shift is in the attack surface: agent orchestration middleware now accounts for 50% of all AI-related flaws, representing a 347% increase in disclosures this year. Over 2,000 cumulative AI-related CVEs have been tracked from January 2025 through August 2026, with more than 1,500 appearing in 2026 alone. Microsoft’s Digital Defense Report 2026 projects approximately 72,000 CVEs for the full year, a record roughly double the prior year.
One caveat: the GTI cautions that raw CVE counts are inflated by automated CNA assignment policies — thousands of Linux kernel CVEs, for instance, contributed to the doubling with zero observed exploited zero-days. The GTI has also not yet observed zero-day exploitation of AI infrastructure itself. Even so, the directional signal is clear: the infrastructure supporting agent-orchestrated environments is generating vulnerabilities faster than conventional triage can process them.
The problem is not just volume. It is the compression of the exploitation window. The Cloud Security Alliance reports that the mean time from disclosure to confirmed exploitation has fallen to less than one day in some categories. The CSA’s research, drawing on third-party sources, suggests AI-generated exploits can be produced in 15 minutes at negligible cost. In-the-wild exploitation has jumped from an average of 10.5 incidents per month in 2025 to 18 per month in 2026, according to the GTI. In the first eight months of 2026, 141 distinct vulnerabilities were exploited — surpassing the 127 recorded for the entirety of 2025. The CVE pipeline was built for discrete, reproducible, vendor-owned software flaws. That model does not accommodate emergent, multi-vendor, non-deterministic agent stacks, where the exploitability of a component depends on how it interacts with six other components none of the same vendor controls.
The speed of weaponization illustrates the gap. CVE-2026-1731, an unauthenticated OS command injection flaw in BeyondTrust Privileged Remote Access, was discovered autonomously by the Hacktron AI research agent. Within four days of public disclosure, the GTI observed one threat cluster exploiting the vulnerability. Five more followed within seven days. AI-discovered vulnerabilities are 50% more likely to lead to remote code execution than the 26% baseline for human-discovered flaws, per the GTI’s analysis. The agents that find the vulnerabilities are accelerating the same pipeline that the disclosure infrastructure cannot track.
The front line of this structural failure is the authentication stack. Over the past three weeks, this desk has documented seven instances of the same pattern: federation layers trusting identity provider assertions without binding them to the intended local context. In Keycloak (Post 131948), delegated admin permissions could be abused to redirect token URLs. Better Auth (Post 132071) stored OAuth state records and Magic Link tokens in the same un-namespaced verification store, allowing cross-flow authentication bypass. Frontegg SAML (Post 132087) lacked assertion-signature validation, creating an unauthenticated admin takeover path. AD FS spoofing (Post 132106) shipped two new CVEs the same week DKM enforcement activated to close exactly this surface. Budibase OIDC/SSO (Post 132121) let an attacker claim another user’s pending admin invite during the OIDC login flow because the invite-matching logic lacked invite-code validation. The Citrix NetScaler SAML (Post 131871) trap repeated twice: the October 3 fix builds sat inside the October 8 RCE’s affected range (Post 132019), meaning administrators who patched on October 3 were running vulnerable software on October 8.
Each of these is a variation of the Golden SAML problem — the federation layer accepts the IdP’s word without verifying that the assertion was intended for this specific user, on this specific system, for this specific operation. The CVE pipeline cannot see these interactions because they are emergent properties of how components compose, not bugs in any single component. The CSA’s finding that 82% of surveyed MCP servers have file operation vulnerabilities points to the same structural gap at a different layer: community-maintained components with no vendor in a position to receive, triage, or remediate disclosures.
With 88% of enterprises experimenting with AI agents and 82% planning broader rollouts within 18 months, per Microsoft’s data, the identity layer is absorbing deployment pressure faster than it can be audited. The structural requirement is a shift from trust-through-defaults — the assumption that a valid IdP assertion is sufficient for access — to context-aware binding that validates the local state at the point of privilege assignment. Manual patching cycles measured in weeks are incompatible with weaponization windows measured in hours. Agent orchestration middleware needs the same vulnerability management discipline that enterprises apply to core identity providers. The seven incidents on this desk in three weeks suggest that discipline is not yet in place.