AI-Era CVE Trends: Discovery and Exploitation

CVE counts are exploding, and everyone is asking the same question: is AI the cause? On September 30, 2026, Google Threat Intelligence Group (GTIG) published one of the first data-driven answers, covering 20 months of disclosure and exploitation data from January 2025 to August 2026.

The short version: AI is measurably changing vulnerability discovery, but not in the way the headlines suggest. Disclosures doubled and exploitation nearly doubled, yet zero-days barely moved. The real acceleration is in n-days, meaning flaws that already have a patch or a public description. AI itself has also become an attack surface, with its own CVEs and its first in-the-wild exploitation.

Key Takeaways

• Disclosures doubled: monthly CVE disclosures rose from 5,045 in January 2026 to 10,477 in July and 10,740 in August.
• Exploitation nearly doubled: GTIG recorded 141 exploited vulnerabilities from January to August 2026, more than all of 2025 (127). That is 18 per month versus 10.5.
• Zero-days are stable-ish: the average moved from 8 to 11 per month. August spiked to 22, but the baseline did not change much.
• N-days drive the growth: GTIG suggests the main source of added exploitation is rapid weaponization of already-disclosed flaws.
• AI finds nastier bugs: 50% of AI-discovered vulnerabilities lead to remote code execution (RCE), against 26% for everything else.
• AI infrastructure is under fire: GTIG tracked 2,076 AI-related CVEs, with over 1,500 in 2026 alone. Orchestration frameworks account for about half.

What GTIG Measured, and What It Did Not

Two methodological points matter before reading any number.

First, GTIG uses its own vulnerability risk ratings, not CVSS. A “High-Risk” CVE here reflects threat intelligence context, such as exploitability and exposure, so the numbers do not map directly to the CVSS scores in your scanner.

Second, AI attribution is a heuristic, and it undercounts. There is no standard CVE metadata field saying “found by an AI agent”. Cloud and SaaS providers also often fix AI-found bugs silently in production, without requesting a CVE. GTIG identified likely AI-discovered flaws by ingesting confirmed disclosures from AI research programs and by parsing advisories that credit autonomous agents (for example Hacktron AI and AISLE). Treat the AI-versus-human comparisons as an early signal, not a settled measurement.

Disclosures Doubled, but Raw Volume Misleads

Monthly disclosures going from 5,045 to over 10,000 sounds like an AI-driven flood. GTIG itself warns that raw volume can be misleading. Automated CVE Numbering Authority (CNA) policies in open-source ecosystems inflate the baseline: CVEs mentioning “Linux Kernel” alone produced roughly 5,000 entries between January and August 2026, with no exploited zero-days among them.

That does not explain everything. From GTIG’s figures (141 exploited, 0.23% of disclosures) you can back out a total of around 61,000 CVEs for the period, so kernel entries are roughly 8% of it. That is my own arithmetic, and GTIG does not publish the monthly distribution. Still, it shows why a count of CVEs is a poor proxy for risk.

The more interesting signal is in High-Risk disclosures: 131 in January 2026 to 350 in August (+167%), though still only 3% of August’s total. Two things drove it:

• A wider vendor pool: baseline High-Risk disclosures roughly doubled, from about 65 per month in mid-2025 to about 135 per month in mid-2026.
• Concentrated vendor events: TOTOLINK consumer router research added 75 High-Risk flaws in April and May. Oracle’s quarterly Critical Patch Update (WebLogic, Coherence) plus Linux kernel network driver advisories contributed 128 High-Risk flaws in August alone, nearly 37% of that month’s total.

Excluding Linux, Oracle, and TOTOLINK, High-Risk growth from January 2025 to August 2026 was 128%, instead of 241%. So the surge is real, but a good part of it is vendor disclosure cycles, not purely AI.

Exploitation: The Story Is N-Days

GTIG’s exploitation numbers are small compared to disclosure, and that is the point: only 0.23% of 2026 disclosures (about 1 in 431) were observed exploited. The patching problem is prioritization, not volume.

Zero-days are still the majority of exploited flaws (62%), but their growth is modest (+59% indexed, with the three-month average only turning up in summer 2026). The rest of the growth is in n-days. Using the rounded averages above, n-day exploitation works out to roughly 2.6 per month in 2025 and 6.6 per month in 2026. That is my derivation, not a GTIG figure, but it matches their conclusion that the primary source of growth is the rapid weaponization of n-days.

GTIG offers a plausible explanation, and flags it as a possibility, not a proven fact: attackers may find it cheaper to use LLMs to diff product versions, read patches and advisories, and turn public proof-of-concept code into working exploits than to hunt for new zero-days.

Where Attackers Hit

Exploitation concentrates on the perimeter. Edge and security appliances made up 14% of exploited vulnerabilities and enterprise directory and collaboration hubs 11%. Over 65% of exploited edge flaws were rated High or Critical, with attackers targeting unauthenticated management interfaces on devices where endpoint detection and response (EDR) agents cannot run. This echoes what GTIG found in its 2024 zero-day review: security and networking products are the favorite entry point.

AI as the Hunter: Different Bugs, Higher Impact

GTIG compared vulnerabilities likely discovered by AI with the rest of the CVE population:

AI-found bugs also skew toward code execution: 50% lead to RCE versus 26% across the wider ecosystem, while information disclosure (8% vs 18%) and data manipulation (5% vs 9%) are under-represented.

GTIG’s reading is largely about how the tools get used. Researchers point agents at critical infrastructure and privilege boundaries instead of running broad scans for cosmetic issues. And agents are good at the multi-step semantic work that defeats traditional static analyzers: synthesizing fuzzing harnesses, modeling memory state, and chaining edge-case logic across C and C++ libraries, runtimes, and hypervisors. The result is more memory corruption and logic bypasses. For the offensive side of the same capability, see our coverage of Anthropic’s Project Glasswing.

A Collision Case: CVE-2026-1731

The best example that defender-found bugs are not safe from attackers is CVE-2026-1731, an unauthenticated OS command injection in BeyondTrust Privileged Remote Access and Remote Support, found autonomously by Hacktron AI’s research agent. After public disclosure:

• Within 4 days, GTIG saw one threat cluster exploiting it.
• Within 7 days, five more clusters had joined.
• Post-exploitation included privilege escalation, data exfiltration, and secondary payloads such as SNOWLIGHT, SPARKRAT, and cryptominers.

GTIG calls this an early indicator, not an established trend. One case does not prove a pattern. But the 4-to-7-day window is the number to hold against your own patch SLAs for internet-facing systems.

AI as the Hunted: Attacks on the AI Stack

The second half of the report is about vulnerabilities in AI systems themselves. GTIG tracked 2,076 AI-related CVEs over the full window and over 1,500 in January to August 2026.

Three themes stand out:

1. Orchestration is the chokepoint. It accounts for about 50% of AI-related flaws, with disclosures up 347% in 2026. Workflow builders often include code-execution nodes, so a prompt or a crafted workflow JSON can turn into unauthenticated RCE.
2. AI gateways concentrate risk. A compromised gateway exposes third-party API keys and prompt streams that may contain PII or source code, and gives attackers a foothold to harvest database credentials and move laterally in cloud environments. We covered one real case in the LiteLLM authentication bypass.
3. Inference servers are the new perimeter. Of the 212 serving-layer flaws, 24% stem from unauthenticated API endpoints or SSRF, giving direct access to GPU compute and model checkpoints.

What Is Actually Being Exploited

GTIG states that no zero-day exploitation of AI infrastructure has been observed yet, and only a handful of the 2,076 CVEs are confirmed exploited. But attackers are already weaponizing fresh disclosures in exposed middleware:

• CVE-2026-42271 (LiteLLM): command injection in MCP server preview endpoints, leading to host takeover and API credential theft.
• CVE-2026-5027 (Langflow): path traversal file write in the upload handler, letting attackers drop cron jobs or SSH keys onto the host.
• CVE-2025-3248 (Langflow): unauthenticated Python code injection via exec(), giving immediate RCE.

The pattern is the same n-day dynamic as elsewhere: public disclosure, then quick exploitation of internet-exposed tools that were never meant to face the internet.

What to Do: From Mass-Patching to Triage

GTIG’s recommendation is to move from unprioritized mass-patching to threat-intelligence-driven triage, combined with targeted edge defense and automated, agentic remediation. Here is how I would turn that into a plan:

1. Rank by exploitation signal, not CVSS alone. With a 0.23% exploitation rate, most CVEs will never matter to you. Prioritize flaws that are known-exploited, internet-facing, or on perimeter appliances. Use a threat-intelligence-based rating and a known-exploited catalog alongside CVSS.
2. Set patch SLAs for the edge in days, not weeks. The CVE-2026-1731 timeline (first exploitation at day 4, six clusters by day 7) means a 30-day window for internet-facing High-Risk flaws is too long. Mitigate first (disable, restrict, or isolate), then patch.
3. Take management interfaces off the internet. Put edge appliance, remote-access, and admin consoles behind a VPN or Zero Trust access. Unauthenticated management interfaces are the exact target GTIG describes.
4. Treat the AI stack as production infrastructure. Inventory Langflow, Flowise, LiteLLM, vLLM, Ollama, MLflow, and vector databases. Do not expose them publicly, require authentication on every admin API, and subscribe to their advisories. Our practitioner guide to MCP security covers hardening for the protocol layer.
5. Sandbox agent workloads. Run workflow engines and code-execution nodes in isolated environments with minimal credentials and restricted egress, so one prompt injection cannot reach your databases or cloud control plane.
6. Automate the response side. If attackers compress the disclosure-to-exploit window with AI, manual ticket queues will not keep up. Use automation for asset matching, exposure checks, and patch deployment, with human approval for risky changes. Our guide to getting Mythos-ready goes deeper on the operating model.
7. If you ship software, review before release. GTIG suggests AI-assisted code review before production, noting that if this becomes standard practice the growth in public disclosures could eventually slow.

Limits of the Data

A few caveats worth keeping in mind when quoting these numbers:

• Single-source dataset. The figures come from GTIG’s own tracking and risk model; I could not independently reproduce them.
• AI attribution is incomplete. Undercounting is acknowledged, so the real share of AI-found bugs is probably higher, and the profile of the missing ones is unknown.
• Correlation, not proof. GTIG does not claim AI caused the doubling in disclosures. Vendor cycles, CNA policies, and more researchers all play a role.
• Short window, partial year. January to August 2026 is eight months, and monthly exploitation counts are small enough that single campaigns move them.
• Early indicators. The BeyondTrust case and the AI-middleware exploits are real, but they are a handful of examples.

Conclusion

The GTIG report replaces a vague fear with something more useful. AI is not producing a wave of unstoppable zero-days. It is compressing the time between disclosure and exploitation, pushing discovery toward high-impact flaws like RCE, and creating a new class of exposed infrastructure in the AI stack itself. Your biggest exposure is not the number of CVEs published, but how fast you can identify the few that reach your perimeter and respond before an attacker’s n-day automation does.

To further enhance your cloud security and implement Zero Trust, contact me on LinkedIn Profile or [email protected].

FAQ

Frequently Asked Questions (FAQ)

Did AI cause CVE disclosures to double in 2026?

GTIG does not claim that. Disclosures rose from 5,045 in January 2026 to 10,477 in July and 10,740 in August, but the report points to other contributors too: automated CNA assignment (about 5,000 Linux kernel CVEs), concentrated vendor cycles such as Oracle and TOTOLINK, and a wider pool of affected vendors. AI-assisted discovery is a measurable factor, but it is hard to isolate because public CVE data has no AI-attribution field.

Is AI increasing zero-day exploitation?

Only marginally so far. GTIG reports an average of 8 zero-days exploited per month in 2025 versus 11 per month from January to August 2026, with an August spike to 22. The bigger growth is in n-day exploitation, which GTIG suggests may reflect attackers using AI tools to analyze patches and proof-of-concept code and weaponize flaws quickly.

What kinds of vulnerabilities does AI find?

GTIG found that AI-discovered vulnerabilities skew toward higher impact. 58% were rated Medium risk (versus 28% for other CVEs), only 39% Low (versus 69%), and 50% lead to remote code execution (versus 26%). GTIG attributes this to how researchers target agents at critical infrastructure and to agents being good at memory corruption and multi-step logic bypasses. AI attribution is heuristic and undercounts, so treat the figures as an early signal.

Which AI tools have been exploited in the wild?

GTIG names CVE-2026-42271 in LiteLLM (command injection in MCP preview endpoints), CVE-2026-5027 in Langflow (path traversal file write), and CVE-2025-3248 in Langflow (unauthenticated Python code injection). Out of 2,076 AI-related CVEs, only a handful are confirmed exploited, and GTIG has not observed zero-day exploitation of AI infrastructure.

How fast do attackers exploit newly disclosed vulnerabilities?

In GTIG's CVE-2026-1731 case (BeyondTrust Privileged Remote Access and Remote Support, found by Hacktron AI), one threat cluster was exploiting the flaw within four days of public disclosure and five more within seven days. It is one case, but it is a useful benchmark for patch SLAs on internet-facing systems.

How should security teams respond to rising CVE volume?

GTIG recommends moving from unprioritized mass-patching to threat-intelligence-driven triage, with targeted edge defense and automated, agentic remediation. In practice: rank by exploitation signal and exposure rather than CVSS alone, patch or mitigate internet-facing appliances within days, remove management interfaces from the internet, inventory and isolate the AI stack, and automate asset matching and patch deployment.

Resources

• Primary source: Vulnerability Discovery and Exploitation Trends in the AI Era (GTIG, September 30, 2026)
• GTIG risk ratings: Separating signal from noise: how Mandiant Intelligence rates vulnerabilities
• GTIG AI Threat Tracker: From Prompting to Autonomy: The Evolution of Adversarial AI
• Mandiant on agentic code review: Staying ahead of adversarial AI through agentic source code review
• Mandiant on defense: AI-Assisted Vulnerability Management
• CVE-2026-1731: Hacktron AI write-up on BeyondTrust Remote Support RCE
• AI middleware exploitation: CSA note on LiteLLM CVE-2026-42271, CSA note on Langflow CVE-2026-5027, and CISA KEV alert for CVE-2025-3248
• Related on this blog: AI-weaponized vulnerability exploit timelines, Zero-Days Exploited in 2024, Anthropic’s Project Glasswing, and Getting Mythos-ready