AI finds plenty of security flaws, but almost none of them get exploited
Quick Answer
In the first half of 2026, AI-assisted discovery identified 1,061 vulnerabilities, with only 14 (1.3%) confirmed exploited.
Quick Take
The time to first confirmed exploit decreased to 80 days, with website content management systems being the most targeted.
Key Points
- AI-assisted tools identified over 23,000 findings, leading to 126 published entries.
- Half of all flaws see exploitation within 80 days of disclosure, down from 120 days.
- Website content management systems account for one-third of all confirmed attacks.
- AI products, including model-building tools, are increasingly targeted by attackers.
- The volume of findings provides little insight into actual risk for defenders.
Source Excerpt
VulnCheck counted how often security flaws found by AI actually get exploited. Out of 1,061 AI-discovered vulnerabilities in the first half of 2026, just 14 saw confirmed attacks. That's 1. 3 percent, the same rate as vulnerabilities overall. But exploits are landing faster, with the median dropping from 120 days to 80.
Want this in your inbox every morning?
Daily brief at your local 8am — bilingual EN/中文, free.
More from The Decoder
See more →
An AI model programmed nonstop for 19 days on a single MirrorCode task that cost $2,600 to run
Epoch AI's MirrorCode benchmark reveals Claude Opus 4.7 as the leader with a 56% solve rate, reconstructing a 16,000-line toolkit in 14 hours. Despite this, all models tested struggle with the most complex tasks, highlighting limitations in current AI capabilities. The single task consumed $2,600 over 19 days, raising questions about cost-effectiveness in AI development.
