AI in cybersecurity sparks new cyber arms race as vulnerability discovery outpaces patching

AI is set to completely transform cybersecurity -- here's how researchers must prepare

For much of my career in computer science, I viewed the detection of software vulnerabilities as a craft. The best researchers combine technical skill with intuition: the ability to tell whether a software crash was a minor glitch or a sign of a more serious vulnerability. For decades, machines found bugs and humans decided which ones mattered. Now, with the advance of artificial intelligence, that is set to change drastically. My research has focused mostly on building better fuzzers -- automated tools that bombard software with millions of unexpected inputs to uncover bugs. Generating crash reports (detailed files that record the failures) was rarely the difficult part. The real challenge came afterwards. Someone still had to investigate each crash, determine whether it was exploitable, decide if it warranted disclosure, and work out how it could be fixed. But AI is spurring a radical shift in how cybersecurity operates, turning vulnerability research into a scalable process that is powered by models, training data and computing power. There are immense challenges as we navigate this path. Here, I sketch the contours of the emerging landscape and lay out open challenges. AI systems can now do much more than generate code. Models that can reason, use tools and run experiments are increasingly capable of triaging software crashes, identifying root causes, assessing exploitability and even proposing fixes. AI can review code that would otherwise go unexamined and shorten the path from bug discovery to a tested fix. Earlier this year, Mozilla, a technology firm in San Francisco, California, used a frontier AI model to uncover and patch 271 vulnerabilities in its Firefox browser for a single version release -- a lot more than its existing tools and reviewers had found each month over the previous year. The sheer number of vulnerability reports that AI enables is stretching the review capacity of even experienced developers. The Linux kernel, the core open-source software that underpins many computer systems, relies on people reporting bugs. But in May 2026, the team that maintains the Linux kernel responded to a surge of duplicate AI-assisted reports by clarifying how such findings should be submitted. The lesson is not that software maintainers are failing, but that machine-generated reports can easily overwhelm processes built for a world in which vulnerabilities were discovered at human speed.

The next cyber arms race isn't about finding bugs. It's about fixing them first.

Why it matters: As AI shrinks the time between a vulnerability's public disclosure and its exploitation, organizations may have only hours -- not days or weeks -- to patch affected systems. Driving the news: Microsoft released fixes for more than 600 vulnerabilities this month, a record that experts say underscores the growing volume of software flaws defenders must now identify, prioritize and patch. * "The bug apocalypse has fully descended upon us," Dustin Childs, head of threat awareness at Trend Micro's Zero Day Initiative, said in a statement. * The Trump administration also said last week it had started accepting reports to its AI vulnerabilities clearinghouse, which was established as part of last month's executive order. The big picture: AI is making both defenders and attackers better at finding software flaws. Security researchers said AI is helping uncover more vulnerabilities than ever, while also raising concerns that attackers will soon be able to weaponize those flaws much faster than organizations can patch them. * In the long run, experts said, AI tools will likely be able to proactively find, dissect and patch vulnerabilities in a system, as well as write code that's free of security flaws from the very beginning. * But in the next two to three years, there will be a gap between when attackers start automating and when defenders will see gains from AI. Threat level: Hackers are also moving at unprecedented speeds. * Hido Cohen, cyber research lead at security firm Dream, said his team has observed an attacker take just nine hours to create a working exploit for a critical flaw after it was disclosed and then point that exploit at government customers. * "Nine hours is faster than most patch approval processes even convene," Cohen said. Reality check: Even before AI tools began accelerating attacks, companies struggled to patch critical security flaws. * Last year, the median time companies took to patch critical bugs rose to 43 days, up from 32 days in 2024, according to Verizon's annual data breach report. Between the lines: Basic cyber defenses like multifactor authentication and identity security are becoming even more important as organizations have less time to patch newly disclosed flaws. * AT&T CISO Rich Baich and RSAC conference chair Hugh Thompson last week called on organizations to focus more on preventing attacks and doubling down on identity security practices like multifactor authentication as attacks start to move at machine speed. * "Our profession shouldn't be defined by how efficiently we observe compromise," Baich and Thompson wrote. "It should be defined by how effectively we reduce the likelihood of compromise in the first place." The intrigue: Former CISA Director Jen Easterly warned last week that her former agency's Known Exploited Vulnerabilities (KEV) catalog will need to be updated for the AI world. * KEV is a widely used catalog of vulnerabilities that hackers are actively exploiting. It helps defenders prioritize which flaws to patch first. * "For widely deployed, internet-facing products, the period in which defenders can wait for confirmed exploitation before acting is shrinking," Easterly wrote. What to watch: The cybersecurity race is starting to shift from building AI that can find vulnerabilities to building AI that can help organizations prioritize, mitigate and eventually remediate them before attackers strike. * Some security vendors are already releasing small language models designed for vulnerability triage and other security tasks, arguing they're cheaper and practical enough to deploy continuously.

How AI could unleash a flood of zero-day vulnerabilities

More than 100 new vulnerabilities are publicly disclosed on an average day, according to Mike Sentonas, president of cybersecurity company CrowdStrike. What was once a trickle has become a torrent, threatening to overwhelm the organizations responsible for keeping critical systems secure. Sentonas, who has worked at CrowdStrike since 2016 and in cybersecurity for more than 20 years, believes the problem has grown so large that major organizations cannot test and install every available fix without risking outages of their own. Security teams are therefore forced to determine which handful of flaws pose the greatest threat. And the problem is likely to get worse. Within months, AI systems capable of finding software bugs at great speed could vastly expand that backlog, while giving attackers the same tools to turn newly discovered flaws into working attacks. "Theoretically, we all wake up and there is just an exponential growth in zero-day vulnerabilities, and there are no patches," Sentonas says. The speed at which AI models can identify zero-day vulnerabilities -- flaws that can be exploited before the software's maker has issued a patch -- may be good news for defenders searching their own systems. But it also means those vulnerabilities can go from hidden in a piece of software to discovered and weaponized far more quickly than before.