AI Is Finding Vulnerabilities Faster Than Defenders Can Act

Vulnerability discovery is speeding up and scaling out, while security teams still have to decide which findings genuinely warrant action.

In the first half of 2026, 35,853 CVEs were published, about 49% more than the year before. Only 495 were catalogued as exploited in the wild during that period, and 116 were already under attack the day they became public. Separately, Anthropic's disclosure data shows Mythos-class models surfacing 26,153 vulnerability candidates in open-source software, with only 421 patched upstream.

That small exploited subset matters. Treating every High or Critical CVSS rating as an emergency is not only impossible, it is the wrong model. The real task is deciding which exposures, on which assets, need immediate action as findings grow and the gap between disclosure and exploitation narrows.

CVSS offers a severity baseline but not the context that determines impact. Automated pentesting provides strong evidence, yet Omdia research found that while 95% of organizations rank pentesting as a top or high priority, only 32% of their average attack surface is tested each year. Exploitability validation, security control validation, and agentic pentesting each answer different questions, and together they support validated attack paths and exposure reduction.

Source: The Hackers News