Security patches need patches now that attackers have AI

Security updates, once thought sufficient, are increasingly being compromised, warns AI-powered penetration testing firm Terra Security. In 2026, a surge in reported patch failures was observed, following years of fewer incidents. This trend coincides with the rise in AI-driven vulnerability discovery and patching. Russian government hackers, for instance, exploited a Windows Shell security bypass before Microsoft released a patch in February.

However, the fix left a second vulnerability, a zero-click authentication coercion flaw, which was also discovered and abused before the second patch in April.

An analysis of every CVE record and GitHub-reviewed advisory revealed a pattern: after a patch, a bypass follows, and another fix is issued. The frequency of GitHub security fixes requiring a follow-up advisory rose from 0.2 percent between 2019 and 2025 to 2.3 percent in 2026. Vulnerabilities with subsequent bypasses were about four times more likely to appear on the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities list compared to other bugs affecting the same vendors.

Server-side request forgery and prototype-pollution fixes are particularly vulnerable, being four and 11 times more common among broken-fix CVEs, respectively.

Kernel vulnerabilities are also more prone to introducing new bugs, with 3.2 percent of kernel CVEs introduced by fix-induced bugs, and 10 percent in busy subsystems like fs/smb and net/sched. Despite this, the silver lining is that it should serve as a wake-up call for software vendors and network defenders to reconsider their "patch and move on" habit.

Before shipping patches, vendors should ask: does the fix address the root cause, cover the entire bug class, and not introduce other issues? Likewise, sysadmins and patch managers should apply the same critical thinking before deploying fixes.