Forget the AI Slowdown—the Vulnerability Explosion Is Already Happening
wired ·
The article argues that a potential industry-wide slowdown in frontier AI development would not stop a vulnerability surge already being driven by widely available AI tools, including open-weight models. Researchers using AI are uncovering software flaws at a rapidly increasing pace, adding pressure to understaffed IT and security teams and open-source maintainers. It cites 974 CVEs patched by Microsoft in September so far, 1,448 Oracle patches in July versus 309 a year earlier, and 1,072 fixes in two June Chrome releases; Mozilla also found 271 Firefox vulnerabilities in one AI-assisted bug-hunting sprint. The cve.icu project recorded 66,401 CVEs by September 16, compared with 33,512 by the same date the previous year and 25,000 during all of 2022. Experts disagree over whether the increase represents a catastrophe, with Jerry Gamblin emphasizing that more CVEs mean more known vulnerabilities rather than necessarily more vulnerabilities. The central concern is that AI could let discovery outpace patching and help attackers find novel flaws, although researchers currently see a fragile balance between AI-assisted offense and defense. Whatever regulation or industry agreement emerges, the article concludes, it cannot undo the vulnerability wave already enabled by existing AI capabilities.
wired