AI security vulnerabilities are on the verge of an explosion

Summary

WIRED reports that the widespread adoption of AI tools has triggered a sudden surge in security vulnerability discoveries. Microsoft patched 974 CVEs in a single month; Oracle published 1,448 patches in July, compared to 309 in the same period last year. The total number of registered CVEs has nearly doubled in less than a year. Amid these developments, AI labs are discussing a collaborative slowdown in the development of frontier models.

Why it matters

The asymmetry between AI-scale discovery and human-scale remediation is already straining under-resourced IT teams and open-source developers. This creates an expanding window of risk for unpatched vulnerabilities. If attackers also adopt AI-assisted hunting at scale, the increase in known vulnerabilities could further weaken overall security postures. The article emphasizes that halting the development of frontier models will not be sufficient to stop the wave of vulnerabilities already being exploited through existing commercial and open-weight models.

Highlights

• Microsoft patched 974 CVEs in a single month. Oracle’s July patches (1,448) were approximately 4.7 times the figure from the previous year. Chrome’s two June releases contained more fixes than the total of its previous 23 major releases.
• Mozilla’s single bug-hunting sprint using Anthropic’s Mythos model uncovered 271 Firefox security vulnerabilities.
• According to RogoLabs data: 66,401 CVEs have been recorded to date. This number was 33,512 as of September 2025 and 25,000 for the entire year of 2022.

Critical take

The article relies too heavily on raw CVE counts as a headline metric. However, expert Gamblin, cited in the article, warns that 'more CVEs does not mean more vulnerabilities, but more known vulnerabilities.' The UK National Cyber Security Centre (NCSC) also notes that the discovery process alone will not improve anything. Unless data on actual exploitation rates or patching delays is provided, the 'explosion' framework risks conflating a measurement artifact with a genuine security crisis.