Security patches need patches now that attackers have AI

Software updates and security patches are no longer enough, as attackers are finding ways to bypass them, according to AI penetration-testing firm Terra Security. The firm discovered a significant increase in patch failures in 2026, with a jump from a 0.2 percent failure rate in 2019-2025 to 2.3 percent this year. This rise is not coincidental, as AI vulnerability discovery and patching also surged this year.

A prime example is the Russian government's exploitation of a Windows Shell security bypass bug, CVE-2026-21510, a month before Microsoft released a patch in February. However, the patch was incomplete, leaving another flaw - a zero-click authentication coercion vulnerability (CVE-2026-32202) - that was also discovered and exploited before Microsoft fixed it in April.

Terra Security reviewed all published CVE records and GitHub-reviewed advisories, finding a pattern of broken fixes. After years of minimal patch bypasses, this changed in 2026: "A fix would ship, a bypass would be found, and another fix would go out." Software vendors and network defenders must reconsider their patching habits.

Instead of blindly applying patches, they should ask three crucial questions: Does the fix address the root cause? Does it cover the entire bug class? Does the update introduce any new issues? By adopting this cautious approach, the cybersecurity community can better protect against the evolving threat landscape.