Forget the AI Slowdown—the Vulnerability Explosion Is Already Happening
Forget the AI Slowdown—the Vulnerability Explosion Is Already Happening. As the situation continues to evolve, an AI slowdown of whatever form—be it regulation or an industry accord—could perhaps/hopefully prevent AI from carrying out a mass human extermination event, but it cannot stop the vulnerability tsunami that has already arrived as a result of existing AI tools.
What happened
As AI leaders consider a cooperative slowdown on frontier model development, though, one aspect of the cybersecurity sea change has already arrived thanks to existing, broadly available capabilities in mainstream AI products, including open weight models. “I don’t think it’s overblown,” Gamblin says of the apparent explosion in vulnerability findings across the industry. AI labs are toying with an industry-wide pact to slow development. Meanwhile, widely available AI chatbots are already helping uncover a tidal wave of security flaws.
AI doomers have recently traded one worst-case scenario for another, putting aside a potential software vulnerability apocalypse to focus on the possibility of rogue AI causing mass human death in the next decade. Google Chrome’s two major version releases in June included 1,072 patches, more than all of the vulnerability fixes shipped in the prior 23 big releases combined. Some have pointed out that slow patch adoption and lagging investment in cybersecurity broadly already gave attackers many advantages that led to hacking disasters before the rise of AI.
But as vulnerability discovery numbers have continued to rise, and the discussion has become less theoretical, the two sides have seemed to move a bit closer.
The wider picture
It's more known vulnerability, which is mostly the system working. ”The fear, though, is that vast vulnerability discovery will mean developers getting outpaced on patching, software users who can’t patch fast enough, and an array of escalating cyberattacks fueled by more attackers discovering novel vulnerabilities on their own using AI. Lauren GoodeOpenAI Wants to Know if an AI Industry Slowdown Would Even Be LegalAI leaders worry antitrust law could stand in the way of what they view as an increasingly urgent push to coordinate a slowdown in AI development.
Skip to main contentSave this storySave this storyWelcome to the inaugural edition of Kernel Panic! A weekly newsletter by Lily Hay Newman and Matt Burgess from inside the new world of privacy and digital security. A tidal wave of vulnerabilities uncovered using AI has only accelerated in recent months—piling more pressure on under-resourced, and very human, IT and security teams and straining volunteers who maintain crucial open source software. Researchers found and disclosed a vast array of vulnerabilities before the rise of AI-enhanced bug hunting as well, but the recent surge is clear.
Microsoft said last week that it has issued patches for 974 CVEs so far this month, setting a new record. (CVEs, or common vulnerabilities and exposures, is cybersecurity jargon for confirmed software flaws. ) In July, Oracle shipped 1,448 patches compared to 309 in July 2025. And Mozilla said in April that it found 271 vulnerabilities in Firefox during one bug hunting sprint using Anthropic’s Mythos model.
What has been reported
Across the board, there have been a stunning 66,401 CVEs recorded as of Wednesday this week, according to Jerry Gamblin, the head of research at Empirical Security and founder of RogoLabs, which runs the CVE analysis project cve. icu. By September 16 last year, cve. icu had logged a total of 33,512 CVEs—almost half the current total. For all of 2022, the year OpenAI launched its first version of ChatGPT, cve. icu recorded 25,000 CVEs. Among both security and AI researchers, experts have been divided about whether this spike and other impacts of AI on cybersecurity will be catastrophic or instead magnify existing dynamics and challenges.
“What I would push back on is the idea that a bigger number is itself the harm. As Britain’s National Cyber Security Center puts it, “Just finding vulnerabilities does nothing to improve your security. ”For now, many researchers tell us that there is at least a tenuous balance between AI accelerating bug discovery and AI aiding defenders. “Actors, just like industry, are trying to figure out, ‘where do I use AI? ’” says Matthew Olney, director of threat intelligence at Cisco Systems.
As RogoLabs Gamblin puts it, “Discovery scales with compute.
What happens next
Remediation scales with people—and people are the part you can't buy more of in a quarter. ”CommentsBack to topJoin the discussionCommentsBack to topYou Might Also LikeIn your inbox: Upgrade your life with WIRED-tested gearMcDonald’s built a 515-page dossier on meBig Story: AI is dead—organoids are aliveThe manosphere is a multibillion-dollar grievance industryHow to find us: Add WIRED. com to your preferred sources in GoogleMatt Burgess is a senior writer at WIRED focused on information security, privacy, and data regulation in Europe.
He graduated from the University of Sheffield with a degree in journalism and now lives in London. She previously worked as a technology reporter at Slate, and was the staff writer for Future Tense, a publication and partnership between Slate, the New America Foundation, and Arizona State University. Kate KnibbsWhy So Many AI Researchers Think the Machines Could Kill EveryoneA combination of rapid advances, recursive self-improvement, and agentic swarms are genuinely “spooking people” inside big labs.
Will KnightI Let an AI Agent Hack All My Gadgets—and I’d Do It AgainAfter I removed the safety guardrails from a powerful open-source model, it found vulnerabilities in my household devices and hacked into a PC. But it also told me how to make everything a lot more secure. Will KnightATM Flaws Reveal Key Weaknesses in the Software Supply ChainA security researcher discovered nine vulnerabilities impacting ATM encryption and authentication software.