AI labs are toying with an industry-wide pact to slow development. Meanwhile, widely available AI chatbots are already helping uncover a tidal wave of security flaws.
AI doomers have recently traded one worst-case scenario for another, putting aside a potential software vulnerability apocalypse to focus on the possibility of rogue AI causing mass human death in the next decade. As AI leaders consider a cooperative slowdown on frontier model development, though, one aspect of the cybersecurity sea change has already arrived thanks to existing, broadly available capabilities in mainstream AI products, including open weight models.
A tidal wave of vulnerabilities uncovered using AI has only accelerated in recent months - piling more pressure on under-resourced, and very human, IT and security teams and straining volunteers who maintain crucial open source software. Researchers found and disclosed a vast array of vulnerabilities before the rise of AI-enhanced bug hunting as well, but the recent surge is clear.
Microsoft said last week that it has issued patches for 974 CVEs so far this month, setting a new record. (CVEs, or common vulnerabilities and exposures, is cybersecurity jargon for confirmed software flaws.) In July, Oracle shipped 1,448 patches compared to 309 in July 2025 . Google Chrome's two major version releases in June included 1,072 patches, more than all of the vulnerability fixes shipped in the prior 23 big releases combined. And Mozilla said in April that it found 271 vulnerabilities in Firefox during one bug hunting sprint using Anthropic's Mythos model.
Across the board, there have been a stunning 66,401 CVEs recorded as of Wednesday this week, according to Jerry Gamblin, the head of research at Empirical Security and founder of RogoLabs, which runs the CVE analysis project cve.icu . By September 16 last year, cve.icu had logged a total of 33,512 CVEs - almost half the current total. For all of 2022, the year OpenAI launched its first version of ChatGPT, cve.icu recorded 25,000 CVEs.
Among both security and AI researchers, experts have been divided about whether this spike and other impacts of AI on cybersecurity will be catastrophic or instead magnify existing dynamics and challenges. Some have pointed out that slow patch adoption and lagging investment in cybersecurity broadly already gave attackers many advantages that led to hacking disasters before the rise of AI. But as vulnerability discovery numbers have continued to rise, and the discussion has become less theoretical, the two sides have seemed to move a bit closer.
"I don't think it's overblown," Gamblin says of the apparent explosion in vulnerability findings across the industry. "What I would push back on is the idea that a bigger number is itself the harm. More CVEs is not more vulnerability. It's more known vulnerability, which is mostly the system working."
The fear, though, is that vast vulnerability discovery will mean developers getting outpaced on patching, software users who can't patch fast enough, and an array of escalating cyberattacks fueled by more attackers discovering novel vulnerabilities on their own using AI. As Britain's National Cyber Security Center puts it , "Just finding vulnerabilities does nothing to improve your security."
For now, many researchers tell us that there is at least a tenuous balance between AI accelerating bug discovery and AI aiding defenders. "Actors, just like industry, are trying to figure out, 'where do I use AI?'" says Matthew Olney, director of threat intelligence at Cisco Systems.
As the situation continues to evolve, an AI slowdown of whatever form - be it regulation or an industry accord - could perhaps/hopefully prevent AI from carrying out a mass human extermination event, but it cannot stop the vulnerability tsunami that has already arrived as a result of existing AI tools.
As RogoLabs Gamblin puts it, "Discovery scales with compute. Remediation scales with people - and people are the part you can't buy more of in a quarter."
In your inbox: Upgrade your life with WIRED-tested gear
The manosphere is a multibillion-dollar grievance industry
How to find us: Add WIRED.com to your preferred sources in Google
Matt Burgess is a senior writer at WIRED focused on information security, privacy, and data regulation in Europe. He graduated from the University of Sheffield with a degree in journalism and now lives in London. Send tips to [email protected] . ... Read More Senior writer Lily Hay Newman is a senior writer at WIRED focused on information security, digital privacy, and hacking. She previously worked as a technology reporter at Slate, and was the staff writer for Future Tense, a publication and partnership between Slate, the New America Foundation, and Arizona State University. Her work ... Read More Senior Writer Topics Kernel Panic vulnerabilities artificial intelligence cybersecurity security hacking Read More Why AI Isn't Likely to Wipe Out Humanity With Bioweapons Of all the threats presented by uncontrollable artificial intelligence, scientists say death by plague ranks low. Kate Knibbs Why So Many AI Researchers Think the Machines Could Kill Everyone A combination of rapid advances, recursive self-improvement, and agentic swarms are genuinely "spooking people" inside big labs. Will Knight I Let an AI Agent Hack All My Gadgets - and I'd Do It Again After I removed the safety guardrails from a powerful open-source model, it found vulnerabilities in my household devices and hacked into a PC. But it also told me how to make everything a lot more secure. Will Knight ATM Flaws Reveal Key Weaknesses in the Software Supply Chain A security researcher discovered nine vulnerabilities impacting ATM encryption and authentication software. But the problems extend far beyond your local cash machine. Lily Hay Newman OpenAI Is About to Release Its First AI Model With 'Critical' Cyber Abilities The company will give select partners early access to its Astra AI model - so they have time to shore up their defenses. Maxwell Zeff Mathematicians Hate AI. They Can't Quit It Powerful AI models have created an existential risk to the field, but researchers can't stop relying on them because they're too useful. Isabella Ward An OpenAI Agent Tried to Jailbreak Itself The company also disclosed previously unreported incidents in which its AI models behaved in misaligned ways, including uploading files to the internet without being asked. Maxwell Zeff Nvidia's Hugging Face Acquisition Is a $12.9 Billion Bet on Open-Source AI The long-rumored deal will give the chip giant access to - and help it promote - a huge repository of open-source AI models and data sets. Lauren Goode OpenAI Wants to Know if an AI Industry Slowdown Would Even Be Legal AI leaders worry antitrust law could stand in the way of what they view as an increasingly urgent push to coordinate a slowdown in AI development. Maxwell Zeff It Still Feels Like Summer in Parts of the US. Blame El Niño Heat records are being shattered thanks to a boost from the natural climate pattern - and burning fossil fuels, of course. Dennis Mersereau What We Still Don't Know About OpenAI's Hugging Face Hack The AI giant acknowledges that it could have done far more to prevent its AI agents from going rogue. But it still fails to explain why it didn't see this fiasco coming. Maxwell Zeff OpenAI Is Developing a 'Persistent' AI Agent Code reviewed by WIRED reveals the company is developing a feature that enables Codex to continue working proactively until it is "put to sleep." Maxwell Zeff WIRED is obsessed with what comes next. Through rigorous investigations and game-changing reporting, we tell stories that don't just reflect the moment - they help create it. When you look back in 10, 20, even 50 years, WIRED will be the publication that led the story of the present, mapped the people, products, and ideas defining it, and explained how those forces forged the future. WIRED: For Future Reference. More From WIRED
Reporting synthesized and verified under Nexvoro.tech editorial guidelines. Full primary records referenced via Wired.
As Prime Minister enters his first parliamentary session, his administration faces a defining crisis over Palantir's sprawling £670m public sector contracts. Westminster insiders warn that deciding the fate of the US tech firm's NHS data agreements requires an immediate, high-stakes executive choice.
Major US television networks and print publications have suspended pooled coverage of President Donald Trump following the exclusion of CNN, Politico, and MS NOW. The affected media organisations have filed a federal lawsuit against the administration, while the White House defends its actions and launches an independent streaming initiative.
Once confident about expanding their Senate majority, Republican strategists are now scrambling to protect traditional strongholds as economic pressures mount across the Midwest. President Donald Trump's economic agenda faces intense scrutiny from voters, altering the trajectory of key legislative races.
