AI found a vulnerability tsunami

Microsoft issued 974 patches this month alone, a new record. Oracle shipped 1,448 patches in July versus 309 last year. Google Chrome released 1,072 fixes in two versions.

The numbers doubled in one year

Total CVEs recorded hit 66,401 as of this week. By September last year, the count was 33,512, almost half. All of 2022 saw just 25,000 CVEs.

AI is helping attackers too

The real fear is that defenders can't patch fast enough while attackers use AI to find novel vulnerabilities on their own. Britain's National Cyber Security Center warns that finding vulnerabilities alone doesn't improve security.

“Just finding vulnerabilities does nothing to improve your security.”

Patching is the real bottleneck

Security experts say the problem isn't finding bugs, it's that patch teams are understaffed and can't scale quickly. Slow adoption of patches already gave attackers advantages before AI arrived.

“Discovery scales with compute. Remediation scales with people, and people are the part you can't buy more of in a quarter.”

An AI slowdown won't stop this

Even if the industry agrees to slow frontier AI development, the vulnerability explosion from existing AI tools has already arrived. The damage from this wave will continue regardless.