- Why CVE Volumes Are Reaching Record Levels
- AI-Generated Code Is Becoming a CVE Production Line
- How AI Is Speeding Up Vulnerability Exploitation
- How AI Is Creating New Types of Vulnerabilities
- The CVE Infrastructure Is Under Increasing Pressure
- How AI Is Helping Defenders Reduce the Gap
- What This Means for Security Programs
- How Cynet Addresses the AI-Accelerated Threat Environment
- Conclusion
For many years, vulnerability management followed a predictable process. A standards organization published a Common Vulnerability or Exposure (CVE), security teams evaluated the associated risk, and organizations gradually completed the required remediation work.
Artificial intelligence has significantly shortened this cycle while introducing additional complexity at almost every stage. As a result, the current landscape of AI-related security vulnerabilities differs substantially from the environment that existed only a few years ago.
Why CVE Volumes Are Reaching Record Levels
The scale of this transformation becomes clear when examining the latest vulnerability statistics.
2025 Results and Emerging 2026 Trends
Recent CVE data shows that vulnerability disclosures continue to grow rapidly, with AI contributing to this acceleration. Security teams must now manage an increasingly broad and complex attack surface.
- A total of 48,185 CVEs were published in 2025. This represented a 20.6% increase compared with 2024 and an average of 131 newly disclosed vulnerabilities per day.
- By the end of 2025, the CVE database had exceeded 300,000 recorded vulnerabilities, demonstrating the expanding scale of modern vulnerability management.
- CVE submissions to the National Vulnerability Database increased by 263% between 2020 and 2025. During the first quarter of 2026, submission volumes were already nearly one-third higher than during the corresponding period of the previous year.
- AI-related vulnerabilities accounted for a record 4.42% of all CVE disclosures in 2025. Their number increased by 34.6% year over year, exceeding 2,100 newly disclosed AI vulnerabilities. The cumulative number of AI-related CVEs has now surpassed 6,000.
AI-Generated Code Is Becoming a CVE Production Line
Artificial intelligence is transforming software development. At the same time, it is introducing new security weaknesses that may later be registered as CVEs.
- According to CodeRabbit’s 2025 State of AI vs. Human Code Generation report, AI-generated code contains 2.74 times more security vulnerabilities than code written by human developers.
- The growing popularity of “vibe coding” is causing more insecure software to reach production environments. Developers increasingly rely on AI systems to generate complete applications with minimal human review.
- Georgia Tech’s Vibe Security Radar identified 56 CVEs associated with AI-generated code during the first quarter of 2026. These included 14 critical and 25 high-severity vulnerabilities involving issues such as command injection, authentication bypass, and server-side request forgery.
- The actual number of vulnerabilities created by AI-generated code is probably much higher. Georgia Tech researchers estimate that open-source software may contain between 400 and 700 such vulnerabilities. Many of them cannot be reliably attributed to AI because coding assistants often leave little or no identifiable metadata in software commits.
How AI Is Speeding Up Vulnerability Exploitation
The growing use of AI in cybersecurity creates new challenges because vulnerability detection and assessment must now operate at unprecedented speed.
Time to Exploitation Has Collapsed
AI-assisted exploit development has dramatically reduced the time available for vulnerability evaluation. In many cases, security teams have almost no opportunity to complete a manual assessment before attackers begin exploitation.
- In 2020, the average period between the public disclosure of a CVE and the publication of a functional exploit was 745 days.
- By 2025, the average interval had fallen to only 44 days across exploited CVEs.
- By early 2026, AI-assisted exploit development had reduced the average time to exploitation to less than 12 hours. Functional exploits frequently appeared before patches, detection signatures, or formal risk assessments became available.
- During the first quarter of 2025, 28.3% of exploited CVEs were weaponized within 24 hours of disclosure. This was an increase from 23.6% during the previous year.
AI Is Discovering Zero-Days Before Defenders
Artificial intelligence is also changing which side identifies vulnerabilities first.
- According to CrowdStrike’s 2026 Global Threat Report, zero-day exploitation increased by 42% year over year in 2025.
- CVE-2025-37899 was discovered with assistance from OpenAI’s o3 model. The model helped identify unsafe memory reuse within approximately 12,000 lines of Linux kernel code.
- AI is shortening multiple stages of the attack lifecycle, including reconnaissance, credential theft, exploit development, and defense evasion.
The Defender’s Dilemma: Exploits Arrive Before Signatures
Signature-based detection is becoming increasingly inadequate as the primary layer of defense. Exploit development now frequently advances faster than vulnerability scanner updates, creating a widening period during which organizations remain exposed.
- More than 54% of CVEs disclosed since January 2025 had no available detection signature from Tenable, Qualys, or Rapid7 at the time of publication.
- For 62% of critical vulnerabilities with known exploits, attackers obtained functional exploit code before scanner detection signatures became available.
LLMs Such as Claude and Codex Are Being Used to Generate Exploits
Large language models represent both a new tool for exploit development and a new attack surface containing vulnerabilities of their own. The technical barrier to creating functional exploits from publicly disclosed CVEs is rapidly disappearing.
- Claude Fable 5 was jailbroken only days after its June 2026 release. A multi-agent technique was used to generate detailed, sequential instructions for exploiting Linux stack buffer overflows.
- A critical command injection vulnerability in OpenAI Codex allowed attackers to steal GitHub access tokens. The attack relied on malicious branch names being passed into environment setup scripts without proper sanitization.
How AI Is Creating New Types of Vulnerabilities
AI Frameworks and Models Are Becoming Attack Surfaces
Attackers are increasingly shifting their attention from traditional infrastructure toward AI-powered applications. Trend Micro reported an 80.4% year-over-year increase in LLM-related CVEs during 2025. At the same time, machine learning frameworks such as TensorFlow, PyTorch, and MLflow collectively account for more than 1,600 known vulnerabilities.
Prompt injection, model poisoning, and AI supply chain attacks have become major categories of security threats. These risks had almost no meaningful presence in the vulnerability landscape only a few years ago.
AI Integrations Are Frequently Insecure by Default
Many AI-generated applications function as expected from an operational perspective. Functional behavior, however, does not guarantee secure default configuration.
CVE-2025-48757 demonstrated how AI-generated software can be delivered with insecure default settings. In this case, an AI coding platform generated Supabase database schemas without Row Level Security policies. Consequently, authenticated users could access or modify information belonging to other users.
AI development tools may also reproduce insecure patterns found in the public software repositories used for model training. This can introduce vulnerabilities such as:
- Authentication weaknesses
- Exposed secrets
- Injection vulnerabilities
As AI-generated code becomes part of future model-training datasets.
The CVE Infrastructure Is Under Increasing Pressure
The NVD Enrichment Crisis
The National Vulnerability Database has traditionally supplied the enriched metadata used by vulnerability management products to assess and prioritize security risks. On April 15, 2026, NIST announced that the NVD would move to a triage-based operating model. Under this model, only an estimated 15–20% of incoming CVEs would receive full enrichment. Approximately 29,000 vulnerabilities from the existing backlog would also be reclassified as “Not Scheduled.”
As a result, many newly published CVEs will not include essential information such as:
- Common Vulnerability Scoring System scores
- Common Platform Enumeration identifiers
- Common Weakness Enumeration mappings
A growing percentage of CVEs will therefore be difficult for traditional scanner-based vulnerability management programs to evaluate and prioritize.
The 2025 MITRE Funding Crisis
In April 2025, the Department of Homeland Security contract that funded MITRE’s CVE and CWE programs expired without an immediate replacement. The programs came within hours of shutting down before CISA issued an emergency 11-month extension.
Although the immediate shutdown was prevented, the long-term funding situation remains uncertain. Alternative projects, including the European Union Vulnerability Database and the Global CVE initiative, have started to emerge.
Additional vulnerability databases may improve the resilience of the global vulnerability-tracking ecosystem. However, they may also create inconsistencies for organizations that have historically depended on CVEs as a universal vulnerability identifier.
How AI Is Helping Defenders Reduce the Gap
Artificial intelligence is not only changing the threat landscape. It is also providing new methods for detecting, prioritizing, and responding to vulnerabilities.
AI-Powered Prioritization
Modern vulnerability management platforms use AI to estimate the probability of exploitation rather than relying exclusively on CVSS severity ratings. This approach gives security teams a prioritized remediation queue based on real-world threat indicators.
AI systems can correlate CVE information with asset inventories, network exposure, and observed attacker behavior. This helps identify which vulnerabilities genuinely require immediate remediation.
AI-based prioritization engines can also learn from historical exploitation patterns, threat actor activity, and global security telemetry. These systems predict which CVEs are most likely to be weaponized next. Security teams receive an actionable, ranked list instead of an unmanageable collection of vulnerabilities marked as critical.
AI-Powered Triage and Decision Support
Prioritization alone does not eliminate the operational bottleneck because every ranked finding still requires a decision. Security teams need more than an indication of which vulnerabilities are dangerous. They also need immediate guidance on the most appropriate response while operating with limited personnel and limited time.
AI-driven triage systems extend prioritization by automating part of the decision-making process. They distinguish findings that require immediate human assessment from those that can be remediated automatically, postponed, or grouped with related issues.
Instead of requiring analysts to open and review dozens of separate tickets, these systems cluster associated vulnerabilities. They identify findings that share a common root cause or affect the same exposure path. The system can then recommend a unified remediation action for the entire group.
This process reduces the time between identifying a risk and taking action. Triage becomes a guided decision workflow rather than a repetitive, ticket-by-ticket manual process. Analysts can complete work in minutes that might otherwise require several hours.
AI-Driven Detection and Autonomous Response
When functional exploits become available before patches, detection and response speed may be more valuable than remediation speed. After a vulnerability has been prioritized and triaged, AI-powered detection systems can monitor for evidence of active exploitation.
These systems may also initiate containment automatically according to predefined rules.
This approach closes the gap between CVE publication and complete vulnerability understanding. Detection, triage, and response no longer operate as separate manual activities. Instead, AI combines them into a continuous process that can function at a speed comparable to modern attackers.
What This Means for Security Programs
Several fundamental elements of modern security programs must change to address AI-enabled threats effectively.
Traditional Patch Management Is No Longer Enough
A weekly or even daily patching schedule cannot adequately address an exploitation window of less than 12 hours for several reasons:
- Scanner-based vulnerability management fails to detect 54% of newly disclosed CVEs at publication. This is also the period during which exploitation risk may be highest.
- Manually triaging an average of 131 new vulnerability disclosures every day is operationally unrealistic for most security teams.
- Programs that rely only on CVSS ratings use incomplete risk indicators. This problem becomes more serious as the NVD enriches less than 20% of newly submitted CVEs.
The New Baseline: AI-Native Detection Supported by Human Expertise
Artificial intelligence has also changed the capabilities organizations should require from security platforms. Behavioral detection identifies exploitation activity in progress instead of merely reporting the presence of vulnerable assets.
Autonomous response enables threats to be contained at machine speed. It eliminates the need to wait for manual approval during the most time-sensitive stages of an attack.
Organizations also require visibility across endpoints, identities, networks, cloud environments, and Software-as-a-Service applications. Comprehensive coverage reduces the blind spots that attackers may exploit.
AI can accelerate detection and response, but experienced security analysts remain essential. Human expertise is still required for investigations, validation, contextual assessment, and high-impact decisions.
Specific Actions for Security Teams and MSPs
Organizations should reevaluate both their vulnerability management processes and their detection capabilities. Security teams and Managed Service Providers should consider the following measures:
- Audit detection coverage. Determine whether existing security technologies can identify exploitation attempts before scanner signatures become available.
- Assess exposure to AI-generated code. Identify where AI tools are used during software development and ensure that the affected repositories are analyzed with security-focused scanning technologies.
- Measure response performance against the current threat timeline. Compare time-to-detect and time-to-respond metrics with the emerging exploitation window of less than 12 hours.
- Remove response bottlenecks. Ensure that the Managed Detection and Response strategy can contain active threats without manual approval delays that provide attackers with additional time to operate.
How Cynet Addresses the AI-Accelerated Threat Environment
AI is reducing the interval between vulnerability disclosure and active exploitation. Cynet’s unified is designed for this operating environment. It combines autonomous detection, automated response, and unified visibility across the attack surface.
CyAI: Autonomous Detection at Machine Speed
A single agent provides visibility across endpoint, network, identity, email, SaaS, and cloud environments. This unified approach reduces the blind spots that attackers increasingly attempt to exploit.
Organizations operating within extremely short exploitation windows require response capabilities that are faster than traditional manual workflows.
CyAI provides 97% autonomous detection and more than 90% automated remediation. These capabilities help contain threats without waiting for scanner signatures or manual approval from a Security Operations Center.
- A 100% MITRE ATT&CK detection rate across three consecutive years demonstrates coverage of techniques used in real-world attacks, including AI-assisted campaigns.
- A false-positive rate below 1% allows organizations to automate response actions without overwhelming analysts with unnecessary alerts.
- Autonomous detection and remediation help reduce the time between identifying malicious activity and containing the associated threat.
CyOps: 24/7 MDR for Exploits That Appear Before Patches
When attackers can weaponize vulnerabilities before patches are released, organizations need expert support that is already active and available. CyOps is Cynet’s continuous 24/7 Managed Detection and Response service.
The service is included with the platform rather than being sold as a separate add-on or requiring an additional contract. Response operations can therefore begin immediately when new threats emerge.
Combined with CyAI’s autonomous detection and remediation capabilities, CyOps provides the speed of artificial intelligence together with the expertise of experienced security analysts. This combination supports complex investigations and high-impact security decisions.
Conclusion
CVE management has entered a period in which traditional vulnerability programs can no longer operate at the required scale or speed. A record 48,185 CVEs were published in 2025, representing an average of 131 new disclosures every day. At the same time, the average interval between disclosure and a functional exploit declined from 745 days in 2020 to less than 12 hours by early 2026.
AI-generated code is directly contributing to this growth. AI-authored pull requests have been found to contain 2.74 times more security issues than human-written code, while vibe-coding practices are introducing additional vulnerabilities into production environments. Security tools are also struggling to keep pace: 54% of CVEs published since January 2025 had no detection signature from major vulnerability scanners at the time of disclosure.
The supporting vulnerability infrastructure is facing similar pressure. The NVD is expected to enrich only 15–20% of incoming CVEs, while MITRE’s CVE program came close to shutting down during the April 2025 funding crisis. These developments weaken the metadata and universal identifiers on which traditional vulnerability management processes depend.
Manual CVE triage and patch-focused workflows are therefore no longer sufficient as standalone strategies. Security programs increasingly require AI-powered prioritization, behavioral detection, automated triage, and autonomous response. These capabilities must be combined with experienced human analysts who can investigate complex incidents, validate automated decisions, and manage high-impact security events.
