AI Tools Spark Record-Breaking Surge in Software Flaws

The integration of artificial intelligence into cybersecurity has unleashed a massive wave of software vulnerability discoveries, far outpacing the capacity of human defenders to patch them. According to Jerry Gamblin, head of research at Empirical Security and founder of RogoLabs, the tracking project cve.icu recorded 66,401 common vulnerabilities and exposures (CVEs) as of mid-September. This represents a staggering increase from the 33,512 CVEs logged by September 16 of last year, and dwarfs the 25,000 CVEs recorded during the entirety of 2022, the year ChatGPT debuted.

Major technology companies are already feeling the strain of this AI-fueled bug-hunting boom. Microsoft set a new record this month by issuing patches for 974 CVEs. In July, Oracle shipped 1,448 patches, compared to just 309 in July 2025. Google Chrome's two major software releases in June bundled 1,072 patches, surpassing the total fixes shipped across its previous 23 major releases combined. Meanwhile, Mozilla utilized Anthropic's Mythos model during a single bug-hunting sprint in April to uncover 271 vulnerabilities within its Firefox browser.

For cybersecurity practitioners, this shift transforms the day-to-day reality of threat management. While finding flaws helps secure systems in theory, the sheer volume of disclosures threatens to bury under-resourced IT departments. As Gamblin observed, bug discovery scales with compute, but remediation "scales with people" who cannot be easily added to a team overnight. Security professionals must now pivot from simple vulnerability discovery to aggressive prioritization, as attackers can also leverage these same AI capabilities to find and exploit unpatched weaknesses before human teams can deploy fixes.