Researchers Find AI Is Accelerating Vulnerability Discovery
AI-powered vulnerability research is contributing to a major increase in security updates, raising concerns that IT teams could fall behind as patching demands grow, according to cybersecurity company ThreatDown.
In a recent blog post, the company stated that in September 2026, vendors addressed 998 common vulnerabilities and exposures (CVEs) around Patch Tuesday, compared with 96 during the same period last year. In addition, the three-month rolling average of patched Linux kernel vulnerabilities tripled year over year, while Google's Chrome browser experienced a 36-fold increase.
The researchers point to advanced AI models, including Anthropic's Claude Mythos Preview, as a major factor behind the increase in vulnerability discovery.
Introduced in April 2026, Mythos Preview is being used through Project Glasswing, an initiative involving Microsoft, the Linux Foundation and other organizations to identify vulnerabilities in critical software.
While AI could ultimately make software more secure, the cybersecurity company warns that vulnerability discovery is accelerating faster than organizations can deploy fixes.
IT teams must still evaluate patches, test compatibility and schedule updates without disrupting critical business operations.
The challenge is particularly significant for organizations already struggling with patch management.
The cybersecurity vendor cites Verizon's 2026 Data Breach Investigations Report, which found that 35% of known actively exploited vulnerabilities remained unpatched after 28 days in 2025.
Ryan Powell, vice president of IT and security at ThreatDown, said automated patching systems can help organizations manage the growing workload. However, additional patches still require more testing and validation, increasing operational overhead and the risks associated with frequent system changes.
Software Supply Chains Face Additional Pressure
The report also highlights the risks of vulnerabilities in widely used software components such as OpenSSL, embedded in applications, network devices, and security products.
Unlike standalone applications, these components often depend on downstream vendors to release updates before organizations can deploy fixes.
The security firm's analysis points to CVE-2022-0778, an OpenSSL vulnerability patched in March 2022, as an example. Some affected products did not receive updates until several months later.
As AI accelerates vulnerability discovery, these dependencies could delay remediation and extend organizations' exposure to known security flaws.
ThreatDown's findings illustrate a growing challenge for enterprise cybersecurity: AI is making vulnerabilities easier to discover but fixing them remains a complex and time-consuming process.
For the full report, visit the ThreatDown blog here.