Forget the AI Slowdown: The Vulnerability Tsunami Is Already Here

The Shifting Frontier of AI Fear and Reality

AI doomers have recently traded one worst-case scenario for another, putting aside a potential software vulnerability apocalypse to focus on the possibility of rogue AI causing mass human death in the next decade. As industry leaders consider a cooperative slowdown on frontier model development, however, a critical aspect of the cybersecurity sea change has already arrived. This transformation is being driven not by science-fiction superintelligence, but by existing, broadly available capabilities embedded within mainstream AI products, including open-weight models.

Across the global technology sector, a tidal wave of vulnerabilities uncovered using artificial intelligence has only accelerated in recent months. This surge is piling immense pressure on under-resourced, and very human, IT and security teams while drastically straining the volunteers who maintain crucial open-source software architectures. Researchers certainly found and disclosed a vast array of vulnerabilities long before the rise of AI-enhanced bug hunting, but the recent velocity and volume of discoveries mark an undeniable inflection point for enterprise risk management.

Record-Breaking Surge in Common Vulnerabilities and Exposures

The sheer scale of the automated bug-hunting phenomenon is reflected in staggering corporate and industry metrics. Microsoft announced that it has issued patches for 974 CVEs so far this month, establishing a formidable new record. In July, Oracle shipped an astonishing 1,448 patches, compared to just 309 in July 2025. Meanwhile, Google Chrome's two major version releases in June included 1,072 patches - surpassing all of the vulnerability fixes shipped in the prior 23 big releases combined. Furthermore, Mozilla reported in April that it uncovered 271 vulnerabilities in Firefox during a single bug-hunting sprint utilizing Anthropic's Mythos model.

This microscopic scrutiny has translated into historic macroeconomic and database milestones. Across the board, there have been a stunning 66,401 CVEs recorded as of Wednesday this week, according to Jerry Gamblin, head of research at Empirical Security and founder of RogoLabs, which runs the CVE analysis project cve.icu. By September 16 last year, cve.icu had logged a total of 33,512 CVEs - almost half the current total. For all of 2022, the year OpenAI launched its first version of ChatGPT, cve.icu recorded a mere 25,000 CVEs, illustrating an exponential scaling curve that aligns directly with the commercial deployment of generative models.

Theoretical Debates Give Way to Operational Reality

Among both security and AI researchers, experts have historically been deeply divided about whether this spike and other impacts of AI on cybersecurity will prove catastrophic or merely magnify existing industry dynamics. Some market analysts have pointed out that slow patch adoption and lagging investment in cybersecurity broadly already gave attackers many tactical advantages that led to hacking disasters long before the rise of generative AI. Yet as vulnerability discovery numbers have continued to climb exponentially, and the discussion has shifted from abstract theory to daily operational crisis, the two competing schools of thought have moved somewhat closer together.

"I don't think it's overblown," Jerry Gamblin says of the apparent explosion in vulnerability findings across the digital landscape. "What I would push back on is the idea that a bigger number is itself the harm. More CVEs is not more vulnerability. It's more known vulnerability, which is mostly the system working." Nevertheless, the underlying anxiety persists among corporate CISOs and software architects: vast vulnerability discovery inevitably risks developers getting outpaced on patching cycles, leaving end users exposed while attackers discover novel zero-day exploits independently using automated tooling.

The Human Bottleneck in the Age of Automated Discovery

As Britain's National Cyber Security Center succinctly observes, "Just finding vulnerabilities does nothing to improve your security." For the present moment, many frontline researchers note that there is at least a tenuous balance between AI accelerating bug discovery and AI aiding system defenders. "Actors, just like industry, are trying to figure out, 'where do I use AI?'" explains Matthew Olney, director of threat intelligence at Cisco Systems, highlighting an ongoing tactical arms race across enterprise networks.

As the situation continues to evolve, an AI slowdown of whatever form - whether implemented via federal regulation or an industry-wide corporate accord - could perhaps prevent advanced systems from carrying out catastrophic harm. However, regulatory brakes cannot stop the vulnerability tsunami that has already arrived as a direct result of existing, accessible AI tooling. Summarizing the fundamental economic mismatch of the current era, RogoLabs' Jerry Gamblin notes: "Discovery scales with compute. Remediation scales with people - and people are the part you can't buy more of in a quarter."