Google Finds AI Is Reshaping Vulnerability Discovery and Exploitation
Summary
Google Threat Intelligence Group found vulnerability disclosures and exploitation rising in 2026. Its report says AI-discovered flaws show a different risk profile, while exploitation growth appears driven mainly by n-days rather than zero-days.
Key points
- Monthly vulnerability disclosures rose from 5,045 in January 2026 to 10,740 in August; GTIG cautioned that automated CVE assignment can inflate raw totals.
- GTIG recorded 141 distinct exploited vulnerabilities in the first eight months of 2026, compared with 127 during all of 2025, but only 0.23% of 2026 disclosures were observed exploited.
- Zero-day exploitation averaged 11 vulnerabilities per month in 2026, up from eight in 2025; GTIG says increased exploitation came primarily from n-days.
- Among likely AI-discovered vulnerabilities, 39% were rated low-risk and 58% medium-risk; half resulted in remote code execution, versus 26% of non-AI vulnerabilities.
- CVE-2026-1731, an unauthenticated command-injection flaw in BeyondTrust products, was discovered by the Hacktron AI research agent and exploited by one threat cluster within four days of disclosure.
- GTIG tracked 2,076 AI-related CVEs from January 2025 through August 2026, including more than 1,500 in 2026; only a handful were confirmed exploited, and no zero-day exploitation of AI infrastructure was observed.
Article Details
- Publisher
- Google Threat Intelligence Group (GTIG)
- Report Period
- 2025-01 through 2026-08
- Scope
- Vulnerability disclosure and exploitation trends, including vulnerabilities likely discovered by AI.
- Sample Size
- GTIG tracked 2,076 AI-related CVEs from January 2025 through August 2026.
- Key Statistics
- Monthly vulnerability disclosures rose from 5,045 in January 2026 to 10,740 in August 2026.
- GTIG recorded 141 distinct exploited vulnerabilities in the first eight months of 2026, compared with 127 in all of 2025.
- About 0.23% of vulnerabilities disclosed in 2026 were observed being exploited.
- Half of AI-discovered vulnerabilities resulted in remote code execution, compared with 26% of non-AI vulnerabilities.
- GTIG recorded 2,076 AI-related CVEs from January 2025 through August 2026; more than 1,500 were recorded in 2026.
CVE
Vendors
Products
BeyondTrust Privileged Remote AccessOne example is CVE-2026-1731, an unauthenticated OS command injection flaw in BeyondTrust Privileged Remote Access and Remote Support, discovered autonomously by the Hacktron AI research agent.LangflowOnly a handful of the 2,076 have been confirmed as exploited in the wild, including flaws in LiteLLM and Langflow.LiteLLMOnly a handful of the 2,076 have been confirmed as exploited in the wild, including flaws in LiteLLM and Langflow.