Software vulnerabilities discovered using AI tools are being exploited at the same rate as those discovered without the use of AI, a VulnCheck researcher has found.
In VulnCheck’s State of Exploitation H1 2026 report, Patrick Garrity, vulnerability researcher, observed that 14 of the 1061 vulnerabilities attributed to AI-assisted discovery have been confirmed as exploited in the wild.
This represents 1.3% of vulnerabilities identified using AI, roughly matching the overall exploitation rate of all vulnerabilities for the reported period.
The researcher also found that while Anthropic reported more than 23,000 findings through its Project Glasswing, only 126 have resulted in published CVEs and just one has been confirmed as exploited in the wild.
These findings add nuance to warnings from some quarters that AI tools like Anthropic’s Mythos and other frontier models could trigger a ‘vulnpocalypse,’ flooding the security landscape with a wave of newly discovered, mass-exploited vulnerabilities.
Garrity said that for now, vulnerability intelligence shows evidence that the use of frontier AI models is “more likely to give cyber defenders an advantage in strengthening software than to give attackers an advantage in discovering vulnerabilities before the software producers do.”
KEV Exploitation Growth Lags Behind Rising CVE Volume
VulnCheck identified nearly 500 known exploited vulnerabilities (KEVs) in the first half of 2026.
These appear to be being exploited faster than ever before, with the median time from CVE publication to KEV falling from 120 days in 2025 to 80 days during the first half of 2026.
However, the research found that 23.43% of KEVs recorded in the first half of 2026 showed evidence of exploitation on or before the day the CVE was published, a slight drop from the 28.93% of one-day and zero-day KEVs observed in 2025.
Additionally, exploitation activity early in the CVE lifecycle remained steady, with roughly 200 CVEs becoming exploited within 31 days in the first half of 2026.
“Early exploitation activity has not scaled at the same pace as CVE issuance,” said Garrity.
Content management systems (CMS) remained the most targeted technology category, accounting for 163 KEVs, one-third of all recorded KEVs.
They are followed by network edge devices (68), operating systems (44) and server software (40).
Meanwhile, AI products are emerging as a new attack surface, with known exploitation affecting model-building tools, workload-scaling platforms, AI gateways, agents and workflow automation.
The VulnCheck report includes every KEV added to VulnCheck’s own KEV catalog during the first half of 2026, based on CVE publication date and earliest evidence of exploitation.
The AI-discovered vulnerabilities mentioned in this report come from both Garrity’s own recording of vulnerabilities reported through Anthropic’s Project Glaswing and telemetry from the Berkeley Vulnerability Research Initiative.
