VulnCheck Finds AI-Discovered Vulnerabilities Were No More Likely to Be Exploited

Summary

VulnCheck found 14 of 1,061 AI-assisted vulnerabilities disclosed in the first half of 2026 were exploited, a rate in line with other vulnerabilities. Exploitation after CVE publication accelerated from 120 days to 80.

Key points

VulnCheck identified 1,061 vulnerabilities attributed to AI-assisted discovery in the first half of 2026; 14, or 1.3%, were exploited in the wild.
The report found no evidence that AI-discovered vulnerabilities were more likely to be exploited than other disclosed vulnerabilities.
Average time from CVE publication to exploitation fell from 120 days in 2025 to 80 days in the first half of 2026.
Content management systems accounted for nearly one-third of 495 known exploited vulnerabilities; network edge devices accounted for almost 14%, operating systems nearly 9%, server software 8%, and AI products almost 6%.
Project Glasswing launched in April, while Microsoft MDASH and OpenAI Daybreak were unveiled in May; none of the models operated throughout the full reporting period.
Microsoft's July security update contained 622 vulnerabilities, following a June update with 206, according to the article.

Article Details

Publisher: VulnCheck
Report Period: First half of 2026
Scope: VulnCheck's review of AI-assisted vulnerability discovery and exploitation data.
Sample Size: 1,061 vulnerabilities attributed to AI-assisted discovery; 495 known exploited vulnerabilities identified.
Key Statistics: Of 1,061 vulnerabilities attributed to AI-assisted discovery in the first half of 2026, 14 (1.3%) were exploited in the wild; VulnCheck said this aligned with the rate across all vulnerabilities during the same period.
Average time from CVE publication to exploitation fell from 120 days in 2025 to 80 days in the first half of 2026.
Content management systems accounted for nearly one-third of 495 known exploited vulnerabilities identified in the first half of 2026; network edge devices accounted for almost 14%, operating systems nearly 9%, server software 8%, and AI products almost 6%.
Microsoft's July 2026 security update contained 622 vulnerabilities, exceeding the previous record of 206 in June.

People

Patrick GarrityVulnCheck security researcher who identified the AI-assisted-discovery vulnerabilities and authored the report.

Vendors

AnthropicAI-assisted vulnerability discovery from systems like Anthropic’s Project Glasswing and Microsoft’s MDASH produced 1,061 flaws in the first half of 2026, but VulnCheck found they were not more likely to be exploited MicrosoftAI-assisted vulnerability discovery from systems like Anthropic’s Project Glasswing and Microsoft’s MDASH produced 1,061 flaws in the first half of 2026, but VulnCheck found they were not more likely to be exploited OpenAIProject Glasswing rolled out in April, while Microsoft’s MDASH and OpenAI’s Daybreak were both unveiled in May.

Products

Daybreak#ProjectGlasswing Microsoft Defender for AI SecurityAI-assisted vulnerability discovery from systems like Anthropic’s Project Glasswing and Microsoft’s MDASH produced 1,061 flaws in the first half of 2026, but VulnCheck found they were not more likely to be exploited Project GlasswingAI-assisted vulnerability discovery from systems like Anthropic’s Project Glasswing and Microsoft’s MDASH produced 1,061 flaws in the first half of 2026, but VulnCheck found they were not more likely to be exploited