AI Is Finding Vulnerabilities Faster Than Humans Can Patch Them — And That’s Becoming a Security Crisis

A security analysis warns that AI-powered vulnerability discovery is outpacing human remediation capacity, citing more than 66,000 CVEs recorded by mid-September 2026 — double the 2025 pace — and Oracle's July 2026 Critical Patch Update, which the company said was its largest ever partly due to AI-powered identification of actionable findings. The piece notes Google Cloud and Microsoft warnings that attackers can use the same frontier models to chain attack paths and scale exploitation, and cites Mandiant's reported 2026 mean time-to-exploit of -7 days, meaning some flaws are exploited before patches exist. The core argument is that machine-speed discovery paired with human-speed patching risks creating 'security debt at machine speed.'

For years, cybersecurity had one obvious problem: Finding vulnerabilities was difficult. Researchers had to inspect code, reproduce strange behavior, understand systems, and sometimes spend days or weeks finding one serious bug. AI is changing that. Modern AI models can now help researchers inspect huge codebases, reason about attack paths, reproduce vulnerabilities, and even suggest fixes. That sounds like great news. And in many ways, it is. But it creates another problem: What happens when we can discover vulnerabilities faster than developers can patch them? I think this is becoming one of the biggest security challenges of the AI era. The numbers are already getting difficult to ignore. By mid-September 2026, more than 66,000 CVEs had reportedly been recorded — more than double the pace seen in 2025. Oracle's July 2026 Critical Patch Update was also its largest security release ever . It covered: Oracle explicitly said the increase reflected, among other things, AI-powered identification of actionable security findings . That is a huge change. For a long time, security teams wanted better ways to find vulnerabilities. Now AI is helping provide exactly that. But discovery is only the first step. Imagine AI finds a serious bug in your authentication system. Discovery might take minutes. But after that, somebody still has to: Confirm the vulnerability ↓ Understand the affected code Design the fix Check backward compatibility Write tests Review the patch Deploy it safely Monitor production Make sure customers actually update That can take hours, days, or much longer. So we may be moving from: Slow discovery ↓ Slow remediation to: Machine-speed discovery ↓ Human-speed remediation That imbalance is the real problem. There is another uncomfortable part. AI vulnerability research isn't only available to defenders. Attackers can use similar models to: Google Cloud has warned about exactly this transition: defenders can use AI to harden software faster, but attackers can also use increasingly capable models to discover and exploit vulnerabilities. Microsoft makes a similar point. Its 2026 Secure Future Initiative report says frontier models are helping attackers discover vulnerabilities, chain attack paths, and scale exploitation faster than traditional manual methods. This changes the race. The old question was: Can an attacker find the vulnerability? The new question may become: Who finds it first — and who acts faster? This is where things become especially difficult. Google's Mandiant team reported that its 2026 data showed a mean time-to-exploit of -7 days . In simple terms, vulnerabilities are sometimes being exploited before a patch is available . Think about what that means for developers. You might not be racing against someone manually reading your code anymore. You could be racing against automated systems continuously searching for weaknesses. And when a vulnerability becomes public, the time between: Disclosure → Exploitation may continue getting shorter. Security teams already have vulnerability backlogs. Imagine a company has: 50 known vulnerabilities and enough engineering capacity to properly fix: 10 per month Now introduce AI-assisted vulnerability discovery. Suddenly the backlog becomes: 50 ↓ 150 ↓ 500 ↓ 1,000 Finding more bugs is useful. But only if we can decide which ones matter and fix them fast enough. Otherwise we create something like: Security debt at machine speed. When vulnerability numbers explode, developers cannot treat every finding equally. A CVSS score alone doesn't tell the whole story. Teams need to ask: A vulnerability in a public API deserves different urgency from one in an isolated internal test system. A theoretical vulnerability and an actively exploited vulnerability are not the same thing. Can an anonymous user exploit it? Or does an attacker already need administrator access? Could the vulnerability expose: If attackers are already using the vulnerability, priority changes immediately. The goal isn't: Patch the highest number of vulnerabilities. The goal is: Reduce the greatest amount of real risk as quickly as possible. This is where I think things become interesting. If AI creates machine-speed vulnerability discovery, we also need machine-assisted remediation . And that is already starting. Google recently released Mantis , an open-source system designed to help automate: Discovery → Triage → Reproduction → Patching Google says the system combines agentic techniques with sandboxed reproduction so findings can be verified instead of relying purely on model guesses. That is important because security AI has another problem: False positives. An AI model saying: “I found a critical vulnerability.” doesn't necessarily mean the vulnerability actually exists. Google notes that sloppy AI scanning can produce extremely weak true-positive rates. So the ideal workflow isn't: AI finds bug ↓ Developer blindly patches It should be: AI discovers candidate ↓ AI reproduces vulnerability ↓ Security tooling validates ↓ AI proposes fix ↓ Tests verify fix ↓ Human reviews ↓ Deploy That is much more useful. For software engineers, I think this means security work is going to become less about simply asking: “Do we have vulnerabilities?” Almost every meaningful codebase will. The better questions will be: Which vulnerability can actually hurt us? Which one is reachable? Which one is being exploited? Which system contains sensitive data? Which fix carries the least production risk? Which patch should go out first? This is prioritization. And AI can help here too. This is an important distinction. If the number of discovered vulnerabilities suddenly doubles, that does not automatically mean developers became twice as bad at writing secure software. It can also mean: Our ability to find existing weaknesses became dramatically better. Think about medical imaging. If a better scanner detects more diseases, that doesn't necessarily mean the population suddenly became much sicker. We simply became better at finding problems that were already there. AI may be doing something similar to software security. That is good. But discovering hidden problems creates a responsibility to deal with them. I don't think the answer is panic. But I do think security processes designed for a slower world need to evolve. Security checks should be part of CI/CD, not something you remember before a release. Combine severity with: Oracle itself is now encouraging customers to move toward a monthly security patching cycle . Organizations with patch processes designed around slow quarterly workflows may struggle as vulnerability discovery accelerates. If AI finds 500 problems but humans have to manually investigate every one, the system doesn't scale. AI-assisted reproduction, triage, testing, and patch generation will become increasingly important. Security patches can break production too. AI can help generate fixes. It shouldn't mean: AI found it → AI patched it → automatically deploy to production. Critical changes still deserve engineering review. The old security loop looked like this: Researcher finds bug ↓ Vendor investigates ↓ Patch released ↓ Attackers reverse-engineer patch ↓ Exploitation begins AI can compress several of those steps. The future could look more like: AI finds vulnerability ↓ AI validates vulnerability ↓ AI develops exploit ↓ AI proposes patch ↓ Humans race to deploy Both sides get faster. Attackers. Defenders. That means the winner may not simply be whoever has the smartest AI. It may be whoever has the fastest trustworthy security process . For years, we wanted machines that could automatically find security vulnerabilities. Now we're getting them. That is a major achievement. But it creates a strange new challenge: What if finding vulnerabilities becomes easier than fixing them? The future of application security will not only be about discovering more bugs. It will be about: Prioritizing faster Validating faster Fixing faster Testing faster Deploying faster without sacrificing reliability. Because if AI can find vulnerabilities at machine speed while organizations still patch them at human speed, the vulnerability itself may no longer be the biggest bottleneck. Our ability to respond will be. Oracle — July 2026 Critical Patch Update Oracle's largest security release to date, covering 1,434 distinct CVEs and highlighting AI-powered vulnerability identification. Google Cloud / Mandiant — AI-Assisted Vulnerability Management Research on AI vulnerability discovery, exploitation speed, and defensive workflows. Google — Mantis Open-source AI-assisted vulnerability discovery, reproduction, triage, and patching. Microsoft — Secure Future Initiative 2026 Discussion of AI accelerating vulnerability discovery and exploitation for both attackers and defenders. Wired — September 2026 Reporting on the rapid growth in vulnerability discovery and CVE volume.