AI-found vulnerabilities

Week of Sep 281

• Sep 28CapabilityGitHub's security team says its open-source AI agent found 24 vulnerabilities in Android apps

Week of Sep 142

• Sep 16CapabilityCisco says frontier AI models helped find six Identity Services Engine flaws, four of them rated 9.9 or above
• Sep 16AttacksCisco confirms active exploitation of a maximum-severity authentication bypass in Identity Services Engine

Week of Sep 72

• Sep 8CapabilitySecurity firm says AI helped it find a WeChat zero-click flaw and write a working remote-code exploit in about two days
• Sep 8DefenseMicrosoft ships its largest Patch Tuesday on record, and the analysts counting it say AI discovery is not producing more exploited flaws

Week of Aug 311

• Sep 3CapabilityMost of the flaws Anthropic's model reported have never been checked by anyone outside the lab

Week of Aug 176

• Aug 20DefenseVulnCheck says AI write-ups and placeholders now outnumber working exploits in public proof-of-concept repositories
• Aug 18CapabilityGoogle says its agentic vulnerability-discovery system found 100-plus critical flaws in two days
• Aug 18CapabilityRapid7 counts 8,539 new high and critical CVEs in the second quarter, double the year before
• Aug 18AttacksA SharePoint flaw found with an AI agent enters CISA's exploited-vulnerabilities catalog
• Aug 18MarketsA carrier's security arm attributes a 36% jump in disclosed vulnerabilities to agentic AI
• Aug 17CapabilityWiz's autonomous red agent found a CI script-injection flaw that GitHub Advanced Security scanned and missed

Week of Aug 104

• Aug 14CapabilityMETR finds vulnerability disclosures rising far faster than confirmed exploitation
• Aug 12PolicyNIST opens a request for information on modernizing the National Vulnerability Database in the age of AI
• Aug 11CapabilitySecurity firm says publicly available AI models let it build a zero-click Zoom RCE in under a day
• Aug 11CapabilityRapid7 used an AI agent to help chain two SharePoint flaws into unauthenticated remote code execution

Week of Aug 33

• Aug 6CapabilityOff-by-1 Labs: about three in four AI-generated vulnerability patches are broken or incomplete
• Aug 5CapabilityPortSwigger's HTTP Terminator: an AI-assisted pipeline invents novel HTTP desync attacks and a live Apache zero-day
• Aug 4CapabilityUnit 42 says its NOVA system found 14,090 unknown vulnerabilities across 3,915 open-source projects in two months

Week of Jul 273

• Jul 31CapabilityEpoch AI counts about 2,500 high and critical CVEs disclosed in July, five times the pre-Mythos record
• Jul 28CapabilityVulnCheck finds AI-discovered vulnerabilities are exploited in the wild at the same low rate as any other
• Jul 28PolicyThe CVE Program lets two AI labs assign CVE identifiers in a closed six-month pilot

Week of Jul 201

• Jul 23CapabilityAn autonomous agent found three critical Microsoft remote-code-execution flaws

Week of Jul 132

• Jul 14PolicyWhite House launches 'Gold Eagle', a Treasury-led clearinghouse for AI-discovered cybersecurity vulnerabilities
• Jul 14DefenseMicrosoft's July Patch Tuesday fixes a record 570 flaws, including multiple Copilot and Azure AI vulnerabilities

Week of Jul 61

• Jul 9CapabilityMicrosoft says AI-driven scanning is changing the pace of vulnerability discovery, and Windows patch volume with it