AI vulnerability discovery

AI vulnerability discovery is the search for flaws through which software can be hacked, carried out by large language models and agents built on them. The model reads code the way a researcher does, forms a hypothesis about where it might break, tests it on its own (it runs the program and reproduces the crash) and often proposes a fix straight away. The same skill also makes it possible to write exploits: programs that make use of a vulnerability.

Automated bug hunting has existed since the late 1980s: fuzzing feeds a program random data and waits for it to crash. Language models added what fuzzing never had: an understanding of what the code means. Since 2024, AI systems have been finding vulnerabilities in the most thoroughly vetted projects: in SQLite, in the Linux kernel and, in 2026, in OpenBSD; by 2026 there were so many findings that maintainers were asking for a slowdown, and the time between the disclosure of a vulnerability and an attack on it had, by Mandiant’s estimate, gone negative: exploitation increasingly begins before a fix is released.¹²³⁴⁵

History

• Autumn 1988 Barton Miller (University of Wisconsin) gives his students an assignment: feed random input to UNIX utilities and see which ones crash. This is how fuzzing comes about; the report on the first experiments comes out in 1990.⁶ ¶ cdwimwe7g
• 04.08.2016 The final of the DARPA Cyber Grand Challenge: automated systems with no human involvement find, fix and exploit vulnerabilities in one another’s software; Mayhem from ForAllSecure wins.⁷ ¶ cz4i8im86
• 01.12.2016 Google launches OSS-Fuzz, free continuous fuzzing for open-source projects. By May 2025 it had helped find and fix more than 13,000 vulnerabilities and 50,000 other bugs in 1,000 projects.⁸⁹ ¶ csci7hdqf
• 01.11.2024 The Big Sleep agent (Google Project Zero and Google DeepMind) finds an exploitable memory-safety bug in SQLite; it was fixed the same day, before it reached a release. Google calls this the first public example of an AI agent finding a previously unknown exploitable vulnerability of this kind in widely used software.¹ ¶ cvs58risf
• 20.11.2024 Google reports that OSS-Fuzz, with language models writing the fuzzing harnesses themselves, has found 26 vulnerabilities, including CVE-2024-9143 in OpenSSL.¹⁰ ¶ cj8mjtrfw
• 31.03.2025 Microsoft describes how it used Security Copilot to find 20 vulnerabilities in bootloaders: 11 in GRUB2 and 9 in U-Boot and Barebox.¹¹ ¶ crcqn37gi
• 22.05.2025 The researcher Sean Heelan uses the o3 model from OpenAI to find CVE-2025-37899 in the Linux kernel’s SMB implementation, through the model’s ordinary API, with no agent harness and no tools.² ¶ cqc89hc5z
• 24.06.2025 The autonomous pentester XBOW takes first place on the US leaderboard of the HackerOne platform: about 1,060 reports, 130 of them closed as resolved.¹² ¶ ckk6b9ywx
• 08.08.2025 The final of DARPA AIxCC: across 63 challenges, AI systems found 54 planted vulnerabilities and fixed 43, and along the way found 18 real ones that nobody had planted.¹³ ¶ cfdcv7m5v
• 06.10.2025 Google DeepMind unveils CodeMender, an agent that not only finds vulnerabilities but also fixes them; by that day 72 of its fixes had been accepted into open-source projects.¹⁴ ¶ cyxfz3zk2
• 18.01.2026 Heelan publishes an experiment in which agents built on Claude Opus 4.5 and GPT-5.2 wrote more than 40 distinct exploits for a QuickJS vulnerability across 6 scenarios; a run of Opus 4.5 cost about $30.¹⁵ ¶ c2ecvyqcx
• 05.02.2026 Anthropic reports that Claude Opus 4.6 has found more than 500 high-severity vulnerabilities in open-source code, validated by humans.¹⁶ ¶ cmh2eexap
• 07.04.2026 Anthropic announces Claude Mythos Preview: in testing, when instructed to, the model found and exploited zero-day vulnerabilities in every major operating system and every major web browser, including a 27-year-old bug in OpenBSD. There are no plans to make the model generally available; alongside it, Anthropic has launched Project Glasswing, a program to protect the most critical software.³ ¶ cvhyb7wnk
• 22.05.2026 Anthropic reports that in more than 1,000 open-source projects Mythos Preview has found 6,202 vulnerabilities of high or critical severity, as rated by the model itself; of the 1,752 checked by independent firms, 90.6% turned out to be real. Some maintainers asked for disclosure to be slowed down because they do not have enough time to fix everything.⁴ ¶ c4tz3r3sx
• 08.10.2026 Anthropic launches Cyber Mission: a program to protect critical infrastructure that gives defenders models and engineers, plus free vulnerability scanning for open-source projects.¹⁷ ¶ c2dt2nmed

How it works

Fuzzing. A program is fed millions of random or slightly corrupted inputs, and the ones that make it crash are recorded. The method does not understand the code and mostly finds bugs that can be “shaken loose”; the hard part is the harness that delivers the data to the right function. That harness is what language models started writing first (OSS-Fuzz, 2024).⁸¹⁰ ¶ cjsug6s2q

Reading code. The model is given a piece of code and looks for bugs in it the way a human does in code review. This is how Heelan found the vulnerability in the Linux kernel. Big Sleep looks for “variants”: it starts from a bug that has already been fixed and searches for similar ones that fuzzing misses.¹² ¶ cb47jiw2v

Verifying a finding. So as not to swamp people with false alarms, the agent reproduces the crash itself: it builds the program, runs it on the inputs it found and sometimes writes a working exploit. At XBOW every finding is confirmed by “validators”: automated checks, some of them based on a language model, others ordinary programs.¹¹² ¶ cmgyijdhr

Fixing. The same agent proposes a patch and runs the tests. In the AIxCC final the systems fixed 43 of the 54 vulnerabilities they found; every CodeMender fix is reviewed by humans before it is sent to a project.¹³¹⁴ ¶ cvbv5ht7u

Data

How much time is left for a fix

How many vulnerabilities are disclosed

What the models can do

[EDITORIAL CONCLUSION] The window for a fix was shrinking even before language models: according to Mandiant, from 63 days in 2018–2019 to 5 days in 2023, and in the 2026 report to an estimated “minus 7 days”. Methodologies change from report to report, and Mandiant itself warns about outliers, so the series shows a direction rather than an exact measurement. What the models change shows up in the count of disclosures: from January to August 2026 their monthly number roughly doubled (Google), and in June serious ones were more than 3.5 times the previous record (Epoch AI). Yet AI findings are so far attacked no more often than others, at 1.3% (VulnCheck), and less than one percent of the Glasswing findings have been fixed. The bottleneck is no longer finding but fixing. ¶ cjx5va73f

Incidents

SQLite: AI got ahead of the attackers, July 2025 ¶ cibk7vmp9

Google reported that Big Sleep, drawing on the company’s threat intelligence, had found the SQLite vulnerability CVE-2025-6965, which was “known only to threat actors” and could have been exploited at any moment. The company called this the first case of an AI agent directly foiling an attempt to exploit a vulnerability in the wild; it disclosed no details about the attackers themselves.²⁶

BeyondTrust: an AI finding attacked within four days, 2026 ¶ cmerq35sd

The vulnerability CVE-2026-1731 in BeyondTrust Privileged Remote Access and Remote Support, which allows commands to be executed without logging in, was found by the autonomous agent Hacktron AI. Four days after disclosure, Google saw one group of attackers exploiting it, then five more. Google itself describes such cases as an “early indicator rather than an established trend”.²³

PHP: the window closed before the release, October 2026 ¶ cgydsfait

On 21 October PHP shipped emergency versions closing two critical vulnerabilities through which code can be executed on a server without authentication. They were reported independently by a researcher at Calif, which was testing PHP under OpenAI’s Patch the Planet program, by OpenAI itself and by Wiz.²⁷

The coordinated release fell apart piece by piece. The day before, the CVE numbers leaked online, Calif mistakenly published a video of a working exploit, and Chainguard posted built images containing the fix more than six hours before the release. According to the PHP Foundation, the video sped up the appearance of exploits, but among those that appeared online it had found no working ones by the time of the release.²⁷ Two days later SANS also wrote that, as far as was known, there was no reliable public exploit, and that among the ones posted there was “an unbelievable amount of ai generated - erm, slop”.²⁸ ¶ c8mhxyghn

Criticism

Noise. The first AI reports were mostly junk. In 2024 Seth Larson of the Python Software Foundation complained about a stream of “extremely low-quality, spammy, and LLM-hallucinated security reports”, and in January 2026 cURL shut down its bug bounty program, unable to cope with the flood of AI reports. More in the article “Maintainer crisis”.²⁹³⁰ ¶ csinq8utk

The turn. In spring 2026 the complaints changed: there were more reports, but they were real. Greg Kroah-Hartman, maintainer of the stable Linux kernel, said in March 2026 that “the world switched” and that every open-source security team was seeing the same thing. Michael Catanzaro of GNOME wrote in July: “Non-AI reports are now moderately unusual.”³¹³² Even earlier, cURL’s author Daniel Stenberg had accepted 22 fixes from a list that Joshua Rogers compiled with the help of AI tools.³³ ¶ ck66wnqkr

The bottleneck is the people who fix. Finding has become cheaper than fixing. Maintainers asked Anthropic to slow down disclosure; by VulnCheck’s count, less than one percent of the Glasswing findings have been fixed, and the model rates severity higher than the maintainers themselves do (91.5% versus 51.3%).⁴²⁵ ¶ ce64vgiy8

Headline numbers. The labs’ claims are hard to verify: in April 2026 The Register, together with VulnCheck, counted Glasswing’s CVEs: “maybe 40. Or maybe none at all”.³⁴ ¶ cefuwix3a

Even being “first” is disputed: OSS-Fuzz and Big Sleep both called their findings the first in the same month of 2024, in different wordings.¹¹⁰ ¶ crua653b7

Dual use. A model that finds and verifies a vulnerability also writes the exploit. From his experiment Heelan concludes that a state’s or group’s ability to break into networks will soon be limited not by the number of hackers but by the number of tokens. Mandiant, meanwhile, is cautious: it does not consider 2025 the year in which breaches became a direct result of AI.¹⁵⁵ ¶ ci86yq385

Development

The large AI labs are turning vulnerability discovery into programs for defenders: Google has Big Sleep and CodeMender, OpenAI has Patch the Planet, and Anthropic has Project Glasswing and Cyber Mission with free scanning of open-source code.^11441727 Open-source projects are responding by changing how they accept reports: in GNOME, reports found without AI have become “moderately unusual”, and according to Catanzaro there is no longer any point in building the process around them.³² ¶ cx859g59f

[EDITORIAL CONCLUSION] Vulnerability discovery is no longer a rare craft: a machine finds the bug, reproduces it and writes a fix, and for tens of dollars a run, an exploit as well. For now, AI findings turn up in real attacks no more often than others (VulnCheck), and Google itself calls such cases an early indicator. The defenders’ advantage runs up against the people who do the fixing: there are fewer fixes than findings, and the window between disclosure and attack has already gone negative. What becomes decisive is not who finds a vulnerability but how quickly it gets closed. ¶ c9iataj44