In 2026, IBM X-Force observed a dramatic surge in publicly disclosed vulnerabilities across major software vendors like Microsoft, Oracle, Google Chrome, and Apache. The number of Common Vulnerabilities and Exposures (CVEs) disclosed rose by 578% compared to the same period in 2025, with AI-assisted vulnerability research emerging as a key factor behind this trend.
Research by Unit 42 revealed that its autonomous vulnerability discovery platform, NOVA, identified over 14,000 previously undiscovered vulnerabilities across nearly 4,000 open-source projects in just two months. This rapid discovery rate raises questions about whether organizations can keep up with the increased pace of vulnerability management.
IBM X-Force analysis found that 55.2% of AI-discovered vulnerabilities were classified as High or Critical severity, with 91.0% being remotely accessible. This shift from discovery to prioritization is challenging for defenders, as the volume of vulnerabilities makes it difficult to remediate them before attackers can exploit them.
The surge in vulnerability disclosures aligns with the growing availability and adoption of AI models supporting vulnerability discovery. While the data does not establish a direct causal relationship, the timing and scale of the increase suggest AI-assisted research may be contributing to higher disclosure volumes.