AI bug flood: how fast can you run?

From January to September 2026, the US National Vulnerability Database published 74,838 new software flaws. Each gets a CVE, the public ID for a disclosed bug. In the same nine months of 2025 it published 36,824, so the count rose 103%. On 14 October Microsoft fixed 1,413 vulnerabilities in one monthly update, more than in all of 2025 (SecurityWeek).

Most people will guess AI, and the evidence agrees. What usually comes with that guess is weaker: the idea that every new frontier model sets off a wave of breaches. The data does not show that. It shows something narrower, and it changes what you should be worrying about.

Discovery: the curve broke in 2026

For three years, model launches barely moved the count. Disclosures were flat or fell after GPT-4, GPT-4o, Claude 4 and GPT-5. The rises after o1 and Gemini 3 were within the normal range, and the jump after Claude 3 lines up with the Linux batch described below. Growth from 26,431 CVEs in 2022 to 49,972 in 2025 has well-documented causes, and none of them needs AI to explain it.

In February 2024 the Linux kernel became its own CVE issuer and started giving IDs to thousands of routine bug fixes. Its team issued more than 1,100 in May 2024 alone, which is much of the spike in the chart (Risky Biz News). In 2025 the WordPress security vendors Patchstack and Wordfence added more than 10,000 between them (Jerry Gamblin, 2025 CVE Data Review).

The curve started to bend around the turn of the year. Mozilla wrote that “since February, the Firefox team has been working around the clock using frontier AI models” to find bugs (Mozilla). On 7 April Anthropic announced Claude Mythos Preview and kept it out of public release because it is so good at finding and exploiting software flaws. Alongside it came Project Glasswing, which gives partner companies and more than 40 organisations that maintain critical software up to $100 million in usage credits to find and fix bugs first (Anthropic).

By 22 May, Anthropic said it and about 50 partners had used Mythos Preview to find more than 10,000 high- or critical-severity flaws. Its own scan of open-source projects flagged another 6,202. Of the 1,752 it had checked, mostly through outside security firms, about 90% were valid and 62% were confirmed as high or critical (Anthropic). A finding is not a published CVE, and many get fixed without ever receiving one.

On 9 June Anthropic released Claude Fable 5, a Mythos-class model for general use, along with Mythos 5, which only Glasswing partners can use. Fable 5 passes cybersecurity requests to an older model instead of answering them, and access to both was suspended on 12 June and restored on 1 July (Anthropic, CNBC). So of the two, the public model is the less likely one to be finding bugs at scale. Mythos 5.1 followed on 1 September (Software Improvement Group). Monthly CVEs went from 5,885 in April to 15,074 in September.

Other tools were at work too. By mid-May, Chrome CVEs were up 563% and GitHub’s 476% on the same period of 2025. VulnCheck suspects “some combination of Mythos and Google’s own AI models” for Chrome, and notes that Microsoft had announced its own AI bug-hunting tool (VulnCheck). Nobody has measured how much of the rise comes from AI. CVE records have no tag for AI-found bugs, and the older causes, such as new CVE issuers, are still there.

Testing every release, not just the one that fits

I wanted to know whether releases matter in general, not just pick the one that fits the story. So I compared the three months before and after each major release, then ranked each result against the same before-and-after comparison at every other month in the series (51 of them). A growing series looks higher after almost any date, which is why the ranking is the fair comparison. It is a ranking, not a test of statistical significance.

A percentile of 92 means about 92% of all the before-and-after comparisons in the series rose less. The typical change was +8.6% for CVEs and +3.2% for ransomware claims. The Claude 3 result coincides with the Linux kernel’s mass CVE issuance in spring 2024, so it is unlikely to reflect the model.

Across the board, releases have no consistent effect. On discovery, the two Mythos-class releases of 2026 stand out. The June window is the largest of all 51, and the only windows bigger than April’s are the two months right after it and February 2024, the Linux batch. Those windows overlap, so they count as one surge, not several separate pieces of evidence.

Attacks: two different stories

Exploitation is rising almost as fast as disclosure. Google’s Threat Intelligence Group (GTIG) counted 141 vulnerabilities exploited in the wild between January and August 2026, against 127 in all of 2025 (Help Net Security). Per month, that is up 67%, against 79% for published CVEs over the same months. By GTIG’s count only 0.23% of this year’s disclosures, about one in 431, have been seen exploited. By this article’s own count the share in 2025 was about the same: 127 exploited against 49,972 NVD records, about one in 390. The worst cases are growing fastest. Exploitation that GTIG rates High Risk went from 28 in 2025 to 75 in eight months, and zero-days rose from 8 to 11 a month. GTIG adds that half the flaws it thinks AI likely found allow remote code execution, meaning an attacker can run their own programs on the target machine. For other flaws the figure is 26%. AI is finding the kind of bug attackers want.

Ransomware has barely moved. A dataset compiled from 17 public breach and ransomware-tracking feeds, with ransomware claims from leak-site trackers such as ransomware.live, RansomLook and ransomfeed.it, counted 12,814 victims posted on extortion sites from January to September 2026. The same months of 2025 had 11,219. That is a rise of about 14%, nowhere near the doubling in disclosed bugs. Historical archives were added to the dataset in September 2026, so the real figure could be somewhat higher or lower.

Three releases were followed by unusually large ransomware rises, and none of them needs the model to explain it:

• After GPT-4 (spring 2023), mass postings by the BianLian, Malas and LockBit gangs drove the jump. Clop’s campaign through the GoAnywhere file-transfer flaw landed in March, the release month itself. Coverage of this period is also the thinnest in the dataset.
• After o1 (late 2024), the rise was spread across Akira, RansomHub, RAWorld, Clop and a newcomer, FunkSec. Check Point found FunkSec’s tools were “likely AI-assisted” and written by inexperienced authors, and warned that its claims may mask a more modest reality, with some leaks recycled from earlier campaigns (Check Point Research).
• After GPT-5 (autumn 2025), the established gangs Qilin and Akira led the posting, with dozens of smaller groups behind them.

The biggest months had ordinary causes as well. In February 2025 the Clop gang posted 361 victims from its campaign against Cleo file-transfer software; without Clop it would have been an ordinary month. August 2026, the record, was led by Clop, Qilin and The Gentlemen with about 200 victims each, plus about 100 smaller groups. Payments point the same way. By Chainalysis’s count, ransom payments fell 8% in 2025 while victims claimed on leak sites rose 50% (Chainalysis).

21 October: how fast the gap can close

PHP2Shell, disclosed on 21 October, is what it looks like when the time between finding a flaw and exploiting it shrinks to hours.

PHP is the programming language behind WordPress, Drupal, Joomla and a large share of the world’s websites. Estimates of exposed servers ran from about 1.3 million (CyberScoop) to 22.6 million (Unit 42), depending on what was counted. The two flaws, CVE-2026-109618 and CVE-2026-109619, let an attacker with no account run code on a web server. On Apache’s mod_php, the most exposed setup, an unauthenticated request can trigger the attack before the website’s own code even runs (Huntress).

AI helped both find the flaw and turn it into a weapon:

• Discovery. The research firm Calif found the bug on 1 August; Fortune reports it used OpenAI’s GPT-5.6 Sol (Fortune). Calif and OpenAI each reported the same root cause to PHP on 11 August, and OpenAI reported more attack paths in September (PHP Foundation). Wiz found the first flaw on 19 August with its own tooling plus Google’s and OpenAI’s models, then worked with PHP, Calif and OpenAI (Wiz). The vulnerable code goes back to PHP 5.4 (Calif), released in March 2012 (PHP).
• Exploit. The researchers say AI let one person build a working attack in about a week, work that would otherwise have taken a team months (The Hacker News). Calif added a caveat: current models “do not reliably begin with obscure twenty-year-old exploitation primitives”, the old building blocks an attack is put together from (Calif).

Then the coordinated disclosure, the agreement to keep a flaw quiet until a fix ships, fell apart:

The leaked video showed the exploit working but gave away little about how it worked, and the PHP Foundation found no working public exploit at release. Within a day, though, the researchers’ write-ups were public and code claiming to be exploits was going around. JFrog documented one such “exploit” on GitHub that turned out to be a prank: it only changed the victim’s wallpaper (JFrog). The attempts people did see probed servers and reworked payloads to get past firewalls. By the evening of 21 October no source had documented webshells, cryptominers or data theft. CISA said it had not observed exploitation (CyberScoop), and the only claim of a break-in was a single unverified account relayed by Fortune. No source says the attackers used AI.

Node.js, the runtime behind much of the web’s server-side JavaScript, fixed 10 flaws the same day. One is a remote-code-execution bug in its Brotli decompression code, CVE-2026-111497, and the advisory does not mention exploitation (Node.js). OpenAI president Greg Brockman, announcing the PHP2Shell coalition, linked to an article saying OpenAI had also been working on “a remote code execution that Node.js announced today”, and that he expected “to find many more such issues over upcoming months” (Greg Brockman on X).

Where the AI attackers actually are

In PHP2Shell, AI found the flaw, but no source has shown attackers using AI to exploit it. The evidence for AI-driven attacks still comes from a handful of documented incidents, not from the aggregate numbers.

Two things run through this list. The fastest security failures after a release hit the model itself: jailbreaks within hours, exposed infrastructure, reported unauthorised access. And the attacks people documented used tools that had been public for months. Anthropic’s September 2026 threat report found that none of the misuse cases it investigated involved its Fable or Mythos-class models, apart from one attempt to copy Fable’s abilities by training another model on its answers. The misuse ran on the older, widely available Haiku, Sonnet and Opus (Anthropic).

What this means

New frontier models have not set off a breach wave each time one ships. What changed in 2026 is discovery. AI-assisted bug hunting is the most likely reason the global count of published flaws doubled in a year, and the restricted Mythos models with their Glasswing partners are the best-documented case.

I’d watch the exploitation numbers. The share of flaws that get exploited has held at roughly one in 400, so when twice as many are found, more get used, and the High Risk end has grown fastest. Fixing is a bottleneck as well. By 2 October, Anthropic’s disclosure dashboard showed 6,157 bugs reported to open-source maintainers and 516 known to be patched (Software Improvement Group).

The same tools that found a flaw sitting in PHP since 2012 built a working exploit for it in a week, and a leaked video put attackers on its trail before most servers were patched. Ransomware numbers have not followed the bug count yet. Whether they do depends less on the next model launch than on how fast fixes reach servers, and how often a disclosure leaks before they do.

What organisations should be ready for

The next model launch is not the thing to plan around. Faster, better-aimed patching is, along with a few habits most security teams already know they need.

1. Know where your common software runs. Estimates of servers exposed to PHP2Shell ran from 1.3 million to 22.6 million, depending on who counted and how. With an up-to-date inventory of languages, runtimes and internet-facing servers, “are we affected?” becomes a query instead of a day of searching.
2. Plan for a much bigger patch load. Attackers still exploit about the same small share of flaws, so more flaws found means more urgent fixes. Exploited flaws are up by about two-thirds this year. Budget staff time and maintenance windows for that, and track how long a critical fix takes to reach production, not just whether one exists.
3. Rank fixes by exploitation, not by volume. No team can treat 15,000 new CVEs a month as equal. Put flaws known to be exploited (CISA’s Known Exploited Vulnerabilities list, vendor and threat-intelligence warnings) and flaws that allow remote code execution at the top. Half the flaws AI finds are the remote-code-execution kind, and the High Risk end of exploitation is growing fastest.
4. Watch the file-transfer and edge products. Some of the biggest ransomware months in this data came from one gang mass-exploiting a single file-transfer product, GoAnywhere in 2023 and Cleo in 2025, not from model launches. Internet-facing file-transfer tools, VPNs and gateways deserve your fastest patch cycle.
5. Assume a disclosure can leak. PHP2Shell went from a forum post to exploitation attempts in under a day, and a day before the fix was due. Keep a tested emergency patch path that can run within hours, plus a fallback for when no fix exists yet: firewall rules, switching off the affected feature, or taking a service offline the way several governments did.
6. Do not run exploit code from strangers. Prank and possibly malicious “proof-of-concept” repositories appeared within a day of PHP2Shell. Test only with code from vendors and researchers you trust, in an isolated environment.
7. Treat your own AI tools as attack surface. Models were jailbroken within hours of launch, and the documented AI-driven attacks ran through coding agents with access to real systems. Limit what AI agents and their plug-ins can reach, keep secrets out of their context, and patch AI software like any other software. GTIG tracked more than 2,000 vulnerabilities in AI-related software since January 2025, about half of this year’s in agent frameworks (Help Net Security).
8. Point the same tools at your own code, with triage ready. Mozilla, Microsoft and the Glasswing partners already run AI bug hunting on their own products. If you do the same, staff the review. Findings need checking before they become fixes, and reported bugs need a route to the people who can patch them.
9. Keep the ransomware basics. Ransomware has not followed the bug count yet, and none of its spikes in this data needed a new technique to explain them. Offline backups you have actually restored from, multi-factor login and the patching above are still the defence that matters.

Method and caveats

• CVE counts were pulled month by month from the NVD public API on 21 October 2026, counting every record NVD published in each month. The 2022–2025 totals match an independent compilation (tecunningham). Jerry Gamblin’s totals (48,185 for 2025) run slightly lower because they leave out rejected records; September 2026 (15,074) is within 1% of his 14,943. GTIG’s monthly figures run lower again because GTIG counts differently.
• Ransomware claims come from a dataset compiled from 17 public breach and ransomware-tracking feeds, measured on 21 October 2026, with posts carried by several feeds merged into one. A claim is a gang’s assertion, not a confirmed breach. Most entries rest on a single feed, and many are dated only to the month, so the analysis works month by month. Historical archives were added in September 2026, which could move the 2025 and 2026 counts in either direction. Other breach types were left out because one-off bulk additions distort their trends.
• The before-and-after test compares the three full months before a release month with the three after it, ranked against the same comparison at every other month. Neighbouring windows overlap, so they are not independent. It is a screen, not a causal model: it does not control for disclosure delays, seasonality or concurrent campaigns. Mythos 5.1 (1 September 2026) is marked on the charts but has fewer than three full months after it, so it is not tested. ChatGPT (November 2022) is marked for context; there are too few months before it to test.
• PHP2Shell reporting reflects sources published up to the evening of 21 October 2026, which disagreed on whether exploitation had begun.
• Checks: research leads were gathered with help from two other AI models and every claim kept was checked against its primary source. The draft was then fact-checked by independent reviewers working from the data and the sources.

Sources

Every claim above links to its source where it is made. The data behind the charts:

• NIST National Vulnerability Database, CVE API 2.0 (monthly queries, pulled 21 Oct 2026): https://services.nvd.nist.gov/rest/json/cves/2.0
• Ransomware leak-site claims from a dataset of 17 public breach and ransomware-tracking feeds, including ransomware.live, RansomLook and ransomfeed.it (measured 21 Oct 2026). RansomLook and ransomfeed.it publish their data under CC BY 4.0 and are credited here as the licence requires.
• Exploitation counts: Google Threat Intelligence Group, via Help Net Security, 1 Oct 2026: https://www.helpnetsecurity.com/2026/10/01/google-ai-discovered-vulnerabilities-remote-code-execution/
• Independent NVD compilation used as a cross-check: https://tecunningham.github.io/ai-discovery-data/cyber-nvd-disclosed.html
• Jerry Gamblin, 2025 CVE Data Review, 1 Jan 2026: https://jerrygamblin.com/2026/01/01/2025-cve-data-review/