{"slug": "ai-is-finding-vulnerabilities-faster-than-humans-can-patch-them-and-thats-a", "title": "AI Is Finding Vulnerabilities Faster Than Humans Can Patch Them — And That’s Becoming a Security Crisis", "summary": "A security analysis warns that AI-powered vulnerability discovery is outpacing human remediation capacity, citing more than 66,000 CVEs recorded by mid-September 2026 — double the 2025 pace — and Oracle's July 2026 Critical Patch Update, which the company said was its largest ever partly due to AI-powered identification of actionable findings. The piece notes Google Cloud and Microsoft warnings that attackers can use the same frontier models to chain attack paths and scale exploitation, and cites Mandiant's reported 2026 mean time-to-exploit of -7 days, meaning some flaws are exploited before patches exist. The core argument is that machine-speed discovery paired with human-speed patching risks creating 'security debt at machine speed.'", "body_md": "For years, cybersecurity had one obvious problem:\n\n**Finding vulnerabilities was difficult.**\n\nResearchers had to inspect code, reproduce strange behavior, understand systems, and sometimes spend days or weeks finding one serious bug.\n\nAI is changing that.\n\nModern AI models can now help researchers inspect huge codebases, reason about attack paths, reproduce vulnerabilities, and even suggest fixes.\n\nThat sounds like great news.\n\nAnd in many ways, it is.\n\nBut it creates another problem:\n\n**What happens when we can discover vulnerabilities faster than developers can patch them?**\n\nI think this is becoming one of the biggest security challenges of the AI era.\n\nThe numbers are already getting difficult to ignore.\n\nBy mid-September 2026, more than **66,000 CVEs** had reportedly been recorded — more than double the pace seen in 2025.\n\nOracle's July 2026 Critical Patch Update was also its **largest security release ever**.\n\nIt covered:\n\nOracle explicitly said the increase reflected, among other things, **AI-powered identification of actionable security findings**.\n\nThat is a huge change.\n\nFor a long time, security teams wanted better ways to find vulnerabilities.\n\nNow AI is helping provide exactly that.\n\nBut discovery is only the first step.\n\nImagine AI finds a serious bug in your authentication system.\n\nDiscovery might take minutes.\n\nBut after that, somebody still has to:\n\n**Confirm the vulnerability**\n\n↓\n\n**Understand the affected code**\n\n**Design the fix**\n\n**Check backward compatibility**\n\n**Write tests**\n\n**Review the patch**\n\n**Deploy it safely**\n\n**Monitor production**\n\n**Make sure customers actually update**\n\nThat can take hours, days, or much longer.\n\nSo we may be moving from:\n\n```\nSlow discovery\n     ↓\nSlow remediation\n```\n\nto:\n\n```\nMachine-speed discovery\n        ↓\nHuman-speed remediation\n```\n\nThat imbalance is the real problem.\n\nThere is another uncomfortable part.\n\nAI vulnerability research isn't only available to defenders.\n\nAttackers can use similar models to:\n\nGoogle Cloud has warned about exactly this transition: defenders can use AI to harden software faster, but attackers can also use increasingly capable models to discover and exploit vulnerabilities.\n\nMicrosoft makes a similar point.\n\nIts 2026 Secure Future Initiative report says frontier models are helping attackers discover vulnerabilities, chain attack paths, and scale exploitation faster than traditional manual methods.\n\nThis changes the race.\n\nThe old question was:\n\n**Can an attacker find the vulnerability?**\n\nThe new question may become:\n\n**Who finds it first — and who acts faster?**\n\nThis is where things become especially difficult.\n\nGoogle's Mandiant team reported that its 2026 data showed a mean **time-to-exploit of -7 days**.\n\nIn simple terms, vulnerabilities are sometimes being exploited **before a patch is available**.\n\nThink about what that means for developers.\n\nYou might not be racing against someone manually reading your code anymore.\n\nYou could be racing against automated systems continuously searching for weaknesses.\n\nAnd when a vulnerability becomes public, the time between:\n\n**Disclosure → Exploitation**\n\nmay continue getting shorter.\n\nSecurity teams already have vulnerability backlogs.\n\nImagine a company has:\n\n```\n50 known vulnerabilities\n```\n\nand enough engineering capacity to properly fix:\n\n```\n10 per month\n```\n\nNow introduce AI-assisted vulnerability discovery.\n\nSuddenly the backlog becomes:\n\n```\n50\n↓\n150\n↓\n500\n↓\n1,000\n```\n\nFinding more bugs is useful.\n\nBut only if we can decide which ones matter and fix them fast enough.\n\nOtherwise we create something like:\n\n**Security debt at machine speed.**\n\nWhen vulnerability numbers explode, developers cannot treat every finding equally.\n\nA CVSS score alone doesn't tell the whole story.\n\nTeams need to ask:\n\nA vulnerability in a public API deserves different urgency from one in an isolated internal test system.\n\nA theoretical vulnerability and an actively exploited vulnerability are not the same thing.\n\nCan an anonymous user exploit it?\n\nOr does an attacker already need administrator access?\n\nCould the vulnerability expose:\n\nIf attackers are already using the vulnerability, priority changes immediately.\n\nThe goal isn't:\n\n**Patch the highest number of vulnerabilities.**\n\nThe goal is:\n\n**Reduce the greatest amount of real risk as quickly as possible.**\n\nThis is where I think things become interesting.\n\nIf AI creates machine-speed vulnerability discovery, we also need **machine-assisted remediation**.\n\nAnd that is already starting.\n\nGoogle recently released **Mantis**, an open-source system designed to help automate:\n\n**Discovery → Triage → Reproduction → Patching**\n\nGoogle says the system combines agentic techniques with sandboxed reproduction so findings can be verified instead of relying purely on model guesses.\n\nThat is important because security AI has another problem:\n\n**False positives.**\n\nAn AI model saying:\n\n“I found a critical vulnerability.”\n\ndoesn't necessarily mean the vulnerability actually exists.\n\nGoogle notes that sloppy AI scanning can produce extremely weak true-positive rates.\n\nSo the ideal workflow isn't:\n\n```\nAI finds bug\n    ↓\nDeveloper blindly patches\n```\n\nIt should be:\n\n```\nAI discovers candidate\n        ↓\nAI reproduces vulnerability\n        ↓\nSecurity tooling validates\n        ↓\nAI proposes fix\n        ↓\nTests verify fix\n        ↓\nHuman reviews\n        ↓\nDeploy\n```\n\nThat is much more useful.\n\nFor software engineers, I think this means security work is going to become less about simply asking:\n\n“Do we have vulnerabilities?”\n\nAlmost every meaningful codebase will.\n\nThe better questions will be:\n\n**Which vulnerability can actually hurt us?**\n\n**Which one is reachable?**\n\n**Which one is being exploited?**\n\n**Which system contains sensitive data?**\n\n**Which fix carries the least production risk?**\n\n**Which patch should go out first?**\n\nThis is prioritization.\n\nAnd AI can help here too.\n\nThis is an important distinction.\n\nIf the number of discovered vulnerabilities suddenly doubles, that does not automatically mean developers became twice as bad at writing secure software.\n\nIt can also mean:\n\n**Our ability to find existing weaknesses became dramatically better.**\n\nThink about medical imaging.\n\nIf a better scanner detects more diseases, that doesn't necessarily mean the population suddenly became much sicker.\n\nWe simply became better at finding problems that were already there.\n\nAI may be doing something similar to software security.\n\nThat is good.\n\nBut discovering hidden problems creates a responsibility to deal with them.\n\nI don't think the answer is panic.\n\nBut I do think security processes designed for a slower world need to evolve.\n\nSecurity checks should be part of CI/CD, not something you remember before a release.\n\nCombine severity with:\n\nOracle itself is now encouraging customers to move toward a **monthly security patching cycle**.\n\nOrganizations with patch processes designed around slow quarterly workflows may struggle as vulnerability discovery accelerates.\n\nIf AI finds 500 problems but humans have to manually investigate every one, the system doesn't scale.\n\nAI-assisted reproduction, triage, testing, and patch generation will become increasingly important.\n\nSecurity patches can break production too.\n\nAI can help generate fixes.\n\nIt shouldn't mean:\n\n**AI found it → AI patched it → automatically deploy to production.**\n\nCritical changes still deserve engineering review.\n\nThe old security loop looked like this:\n\n```\nResearcher finds bug\n        ↓\nVendor investigates\n        ↓\nPatch released\n        ↓\nAttackers reverse-engineer patch\n        ↓\nExploitation begins\n```\n\nAI can compress several of those steps.\n\nThe future could look more like:\n\n```\nAI finds vulnerability\n        ↓\nAI validates vulnerability\n        ↓\nAI develops exploit\n        ↓\nAI proposes patch\n        ↓\nHumans race to deploy\n```\n\nBoth sides get faster.\n\nAttackers.\n\nDefenders.\n\nThat means the winner may not simply be whoever has the smartest AI.\n\nIt may be whoever has the **fastest trustworthy security process**.\n\nFor years, we wanted machines that could automatically find security vulnerabilities.\n\nNow we're getting them.\n\nThat is a major achievement.\n\nBut it creates a strange new challenge:\n\n**What if finding vulnerabilities becomes easier than fixing them?**\n\nThe future of application security will not only be about discovering more bugs.\n\nIt will be about:\n\n**Prioritizing faster**\n\n**Validating faster**\n\n**Fixing faster**\n\n**Testing faster**\n\n**Deploying faster**\n\nwithout sacrificing reliability.\n\nBecause if AI can find vulnerabilities at machine speed while organizations still patch them at human speed, the vulnerability itself may no longer be the biggest bottleneck.\n\n**Our ability to respond will be.**\n\n**Oracle — July 2026 Critical Patch Update**\n\nOracle's largest security release to date, covering 1,434 distinct CVEs and highlighting AI-powered vulnerability identification.\n\n**Google Cloud / Mandiant — AI-Assisted Vulnerability Management**\n\nResearch on AI vulnerability discovery, exploitation speed, and defensive workflows.\n\n**Google — Mantis**\n\nOpen-source AI-assisted vulnerability discovery, reproduction, triage, and patching.\n\n**Microsoft — Secure Future Initiative 2026**\n\nDiscussion of AI accelerating vulnerability discovery and exploitation for both attackers and defenders.\n\n**Wired — September 2026**\n\nReporting on the rapid growth in vulnerability discovery and CVE volume.", "url": "https://wpnews.pro/news/ai-is-finding-vulnerabilities-faster-than-humans-can-patch-them-and-thats-a", "canonical_source": "https://dev.to/robertadam987_/ai-is-finding-vulnerabilities-faster-than-humans-can-patch-them-and-thats-becoming-a-security-1j04", "published_at": "2026-09-20 04:05:16+00:00", "updated_at": "2026-09-20 04:24:30.356790+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence"], "entities": ["Oracle", "Google Cloud", "Microsoft", "Mandiant", "Google", "CVSS"], "alternates": {"html": "https://wpnews.pro/news/ai-is-finding-vulnerabilities-faster-than-humans-can-patch-them-and-thats-a", "markdown": "https://wpnews.pro/news/ai-is-finding-vulnerabilities-faster-than-humans-can-patch-them-and-thats-a.md", "text": "https://wpnews.pro/news/ai-is-finding-vulnerabilities-faster-than-humans-can-patch-them-and-thats-a.txt", "jsonld": "https://wpnews.pro/news/ai-is-finding-vulnerabilities-faster-than-humans-can-patch-them-and-thats-a.jsonld"}}