AI Is Finding Software Flaws Faster Than Anyone Can Fix Them. Here's Why Experts Say Don't Panic Yet.
A new report tracked nearly 40,000 software vulnerability reports across a year of real data. The headline number is alarming. The fine print is more reassuring.
Key points
- Monthly reports of newly discovered software flaws rose 145% in two years, from 3,173 in June 2024 to 7,765 in June 2026, driven partly by AI tools scanning code at machine speed.
- AI research tool Claude Mythos can help develop a working exploit (a ready-made method of attacking a flaw) in under one day, for less than $2,000.
- Fewer than 10% of the potential vulnerabilities Mythos flagged were independently confirmed, suggesting AI over-counts serious threats.
- 89% of examined vulnerabilities already had an official fix available, yet nearly 40% of fixable flaws sat unresolved for more than six months.
- 56% of container vulnerabilities, meaning security gaps in the software packages companies bundle together to run applications, came from code that was not needed in production at all.
Software security teams have watched the number of publicly reported flaws climb sharply for two years straight, and a lot of the blame sits with artificial intelligence. AI tools can now scan millions of lines of code in the time it would take a human researcher to read a short chapter. The result is a flood of new vulnerability reports, CVEs (short for Common Vulnerabilities and Exposures, the official catalogue that tracks known software flaws), that defenders must sort through.
The question is whether that flood is as dangerous as the raw numbers suggest.
How fast is the problem actually growing?
Fast, but context matters. Annual CVE disclosures jumped from 30,949 in 2023 to 49,979 in 2025, and 2026 is on course to beat that figure again, according to a new report from software supply chain security firm Echo, first covered by Dark Reading.
Echo spent a year tracking nearly 40,000 individual CVE life cycles across 250 open source container projects. Containers are pre-packaged bundles of software that companies use to run applications reliably across different computers. The firm also surveyed more than 80 senior security leaders and ran an independent analysis of Anthropic's AI research tool Claude Mythos.
| Metric | Earlier figure | Later figure | Period |
|---|---|---|---|
| Monthly CVE disclosures | 3,173 | 7,765 | June 2024 to June 2026 |
| CVEs in Node base images | ~16,000 | ~70,000 | Jan to June 2026 |
| CVEs in Python base images | ~17,500 | ~45,000 | Jan to June 2026 |
| Annual CVE disclosures | 30,949 | 49,979 | 2023 to 2025 |
Node and Python are two of the most popular programming environments used to build web applications and internal business tools. The surge in known flaws inside them is striking. But Echo cautions that volume is not the same as danger.
Should companies be worried about AI-powered attacks?
Yes, but with important caveats. Mythos can build a working attack against a known flaw in under one day for less than $2,000. That drops the cost of exploit development, meaning criminals with limited budgets can now move faster from "flaw discovered" to "attack launched." That is a genuine shift.
However, AI is better at finding flaws than judging how serious they are. Of the 23,019 potential vulnerabilities Mythos identified, fewer than 10% were independently confirmed. Anthropic publicly disclosed 27 flaws; Mythos initially rated eight as critical (meaning attackers could cause serious damage). After independent review, only one kept that label.
"Mythos is really good at finding real vulnerabilities, but it's much less reliable at determining how serious those vulnerabilities actually are," said Eylam Milner, chief technology officer and co-founder at Echo.
What should organisations do right now?
Focus on the basics first. Echo's data shows 89% of the flaws it examined already had an official patch (a software update that closes the gap) available. The problem is deployment: nearly 40% of patchable flaws remained open for more than six months.
Fixes sit undeployed because applying one often means upgrading related software, running compatibility tests, and moving the change through a normal development process that competes with other work.
Beyond patching speed, Echo found that more than half of container vulnerabilities came from software components companies did not even need running in production. Removing unused code before worrying about the latest AI-discovered flaw is a straightforward first step any organisation can take.
For ordinary users, the practical message is simple: keep your own software and apps updated, and treat any unexpected message asking you to click a link or provide a password with suspicion, because criminals using these tools tend to follow up discovered flaws with phishing emails designed to trick people into handing over access.
