Google reports AI doubles vulnerability disclosures in 2026
Google’s Threat Intelligence Group found monthly software vulnerability disclosures doubled from January to August 2026, rising from 5,045 in January to 10,740 in August. GTIG warned that automated tagging in open-source ecosystems inflates totals, citing 5,000 Linux Kernel-related records with no wild exploits despite their volume.
Key points
- Google’s Threat Intelligence Group saw vulnerability disclosures double from 5,045 in January to 10,740 in August 2026
- AI-found flaws account for half of disclosures, with 58% rated moderate risk—higher than human-scanned bugs
- BeyondTrust’s CVE-2026-1731, found by Hacktron AI, was exploited within four days of disclosure
Exploited flaws also grew: 141 were used in the wild between January and August, up from 127 in all of 2025. Zero-days averaged 11 per month this year, with August spiking to 22. GTIG linked AI’s ability to identify memory corruption and logic flaws in C/C++ code to the higher risk profile. The report highlighted CVE-2026-1731, an AI-discovered flaw in BeyondTrust’s products exploited within days of disclosure. AI software itself saw 2,076 disclosures since 2025, with 1,500+ in 2026, driven by workflow builders like Flowise and Langflow. GTIG advised prioritizing patches based on threat intelligence and urged vendors to use AI for pre-release code reviews.
Google finds vulnerability disclosures doubled as AI changes which flaws get discovered
siliconangle.com · 30 September 2026
Loading the full article…
This text was published by siliconangle.com and written by Duncan Riley. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Policy & Regulation
All →- LASST sues OpenAI over autonomous AI agents hacking Hugging Face · 4 src
- Amazon blocks Meta’s Muse agent over credential risks and lack of identification · 2 src
- UK’s MI5 warns universities to end ties with China’s General Technology Research Institute · 1 src
- Meta’s Muse AI agent allegedly accesses user messages without permission · 1 src
- Nvidia launches AI security platform with industry partners · 3 src
Comments
via GitHub Discussions