{
  "id": 8604164,
  "title": "AI Is Finding Vulnerabilities Faster Than Humans Can Patch Them — And That’s Becoming a Security Crisis",
  "url": "https://urgent.news/2026/09/20/ai-is-finding-vulnerabilities-faster-than-humans-can-patch-them-and",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-20T04:05:16.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/robertadam987_/ai-is-finding-vulnerabilities-faster-than-humans-can-patch-them-and-thats-becoming-a-security-1j04"
  },
  "original_language": "en",
  "account": "Cybersecurity has long struggled with the challenge of discovering vulnerabilities. Researchers had to manually inspect code, reproduce strange behavior, and understand systems, often spending days or weeks to uncover a single serious bug. However, the introduction of artificial intelligence is changing the landscape. Modern AI models can now help researchers inspect large codebases, reason about attack paths, reproduce vulnerabilities, and even suggest fixes.\n\nWhile this sounds like a positive development, it also creates a new problem: if vulnerabilities can be discovered faster than developers can patch them, we may face a security crisis. The numbers are already alarming. By mid-September 2026, over 66,000 CVEs had been recorded, more than doubling the pace seen in 2025. Oracle's July 2026 Critical Patch Update was its largest security release ever, covering 1,449 security patches, 1,434 distinct CVEs, and 334 Oracle products.\n\nAI-powered vulnerability discovery is a significant change, but finding a vulnerability is only the first step. Confirming the vulnerability, understanding the affected code, designing the fix, checking backward compatibility, writing tests, reviewing the patch, deploying it safely, and monitoring production can all take hours, days, or longer. This creates an imbalance between machine-speed discovery and human-speed remediation.\n\nUnfortunately, attackers can also use AI for vulnerability research, allowing them to analyze public patches, search for vulnerable code, identify attack paths, automate reconnaissance, and scale exploitation faster than traditional manual methods. This changes the dynamics of the race, as the focus may shift from \"Can an attacker find the vulnerability?\" to \"Who finds it first, and who acts faster?\"\n\nIn some cases, exploitation may start before a patch is available. Google's Mandiant team reported a mean time-to-exploit of -7 days, meaning vulnerabilities are sometimes being exploited before a patch is even released. This presents a significant challenge for developers, who may now be racing against automated systems continuously searching for weaknesses. Once a vulnerability becomes public, the time between disclosure and exploitation may continue to get shorter.\n\nThe new bottleneck is patching. Security teams already have vulnerability backlogs, and with AI-assisted vulnerability discovery, the backlog could expand rapidly. For example, if a company has 50 known vulnerabilities and can fix 10 per month, AI-assisted discovery could quickly increase the number of vulnerabilities to find, such as 150, 500, or even 1,000. Only if we can prioritize and fix vulnerabilities quickly can we avoid creating \"security debt at machine speed.\"\n\nDevelopers cannot treat every finding equally. They need to consider factors such as whether the vulnerability is internet-facing, actively exploitable, requires specific permissions, exposes sensitive data, or has evidence of active exploitation. The goal isn't to patch the highest number of vulnerabilities, but to reduce the greatest amount of real risk as quickly as possible.\n\nAI should also help fix vulnerabilities, and this is already starting. Google recently released Mantis, an open-source system designed to help automate discovery, triage, reproduction, and patching. Mantis combines agentic techniques with sandboxed reproduction to verify findings instead of relying solely on model guesses. However, security AI still faces challenges, such as false positives, which can produce extremely weak true-positive rates. Ideally, the workflow should involve AI discovering candidate vulnerabilities, reproducing them, validating them with security tooling, proposing a fix, testing the fix, and then having a human review before deployment. This approach is much more useful and efficient than simply relying on AI to find bugs and blindly patching them.",
  "summary": "For years, cybersecurity had one obvious problem: Finding vulnerabilities was difficult. Researchers had to inspect code, reproduce strange behavior, understand systems, and sometimes spend days or weeks finding one serious bug. AI is changing that. Modern AI models can now help researchers inspect huge codebases, reason about attack paths, reproduce vulnerabilities, and even suggest fixes. That…",
  "key_points": [
    "AI models accelerate vulnerability discovery, uncovering over 66,000 CVEs by mid-2026.",
    "Human patching speed lags behind AI discovery, creating a security crisis.",
    "AI-powered tools like Google's Mantis aim to automate vulnerability triage and patching."
  ],
  "editors_take": "The accelerating pace of AI-powered vulnerability discovery is outpacing human ability to patch them, creating a security crisis that shifts the dynamics of vulnerability exploitation and patching.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}