AI in cybersecurity threatens to unleash flood of zero-day vulnerabilities faster than teams can patch

AI is set to completely transform cybersecurity -- here's how researchers must prepare

For much of my career in computer science, I viewed the detection of software vulnerabilities as a craft. The best researchers combine technical skill with intuition: the ability to tell whether a software crash was a minor glitch or a sign of a more serious vulnerability. For decades, machines found bugs and humans decided which ones mattered. Now, with the advance of artificial intelligence, that is set to change drastically. My research has focused mostly on building better fuzzers -- automated tools that bombard software with millions of unexpected inputs to uncover bugs. Generating crash reports (detailed files that record the failures) was rarely the difficult part. The real challenge came afterwards. Someone still had to investigate each crash, determine whether it was exploitable, decide if it warranted disclosure, and work out how it could be fixed. But AI is spurring a radical shift in how cybersecurity operates, turning vulnerability research into a scalable process that is powered by models, training data and computing power. There are immense challenges as we navigate this path. Here, I sketch the contours of the emerging landscape and lay out open challenges. AI systems can now do much more than generate code. Models that can reason, use tools and run experiments are increasingly capable of triaging software crashes, identifying root causes, assessing exploitability and even proposing fixes. AI can review code that would otherwise go unexamined and shorten the path from bug discovery to a tested fix. Earlier this year, Mozilla, a technology firm in San Francisco, California, used a frontier AI model to uncover and patch 271 vulnerabilities in its Firefox browser for a single version release -- a lot more than its existing tools and reviewers had found each month over the previous year. The sheer number of vulnerability reports that AI enables is stretching the review capacity of even experienced developers. The Linux kernel, the core open-source software that underpins many computer systems, relies on people reporting bugs. But in May 2026, the team that maintains the Linux kernel responded to a surge of duplicate AI-assisted reports by clarifying how such findings should be submitted. The lesson is not that software maintainers are failing, but that machine-generated reports can easily overwhelm processes built for a world in which vulnerabilities were discovered at human speed.

How AI could unleash a flood of zero-day vulnerabilities

More than 100 new vulnerabilities are publicly disclosed on an average day, according to Mike Sentonas, president of cybersecurity company CrowdStrike. What was once a trickle has become a torrent, threatening to overwhelm the organizations responsible for keeping critical systems secure. Sentonas, who has worked at CrowdStrike since 2016 and in cybersecurity for more than 20 years, believes the problem has grown so large that major organizations cannot test and install every available fix without risking outages of their own. Security teams are therefore forced to determine which handful of flaws pose the greatest threat. And the problem is likely to get worse. Within months, AI systems capable of finding software bugs at great speed could vastly expand that backlog, while giving attackers the same tools to turn newly discovered flaws into working attacks. "Theoretically, we all wake up and there is just an exponential growth in zero-day vulnerabilities, and there are no patches," Sentonas says. The speed at which AI models can identify zero-day vulnerabilities -- flaws that can be exploited before the software's maker has issued a patch -- may be good news for defenders searching their own systems. But it also means those vulnerabilities can go from hidden in a piece of software to discovered and weaponized far more quickly than before.