--- url: "https://www.xcademia.com/news/google-finds-ai-is-reshaping-vulnerability-discovery-and-exploitation" title: Google Finds AI Is Reshaping Vulnerability Discovery and Exploitation description: "Google Threat Intelligence finds AI is changing vulnerability discovery, exploitation and the security risks facing AI infrastructure." publishedAt: "2026-10-01T09:57:42.834+00:00" updatedAt: "2026-10-08T14:39:05.453879+00:00" type: news category: cybersecurity source_name: Google Cloud Blog source_url: "https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era" tags: - "#Cybersecurity" - "#AI" - "#ThreatIntelligence" - "#Vulnerabilities" - "#CVE" - "#AISecurity" - "#ZeroDay" - "#VulnerabilityManagement" --- # Google Finds AI Is Reshaping Vulnerability Discovery and Exploitation > Google Threat Intelligence Group says vulnerability disclosures and exploitation both increased in 2026, while AI-assisted discovery is surfacing proportionally more moderate- and high-impact vulnerabilities, including flaws leading to remote code execution. Source: **Google Cloud Blog** · 1 October 2026 **T**he volume of software vulnerabilities is rising sharply in 2026, but Google Threat Intelligence Group (GTIG) says the more important change may be what those vulnerabilities look like and how quickly they are being exploited. In a new analysis covering vulnerability activity from January 2025 through August 2026, GTIG examined vulnerability disclosures, exploitation in the wild, risk ratings, AI-assisted discovery and vulnerabilities affecting the artificial intelligence technology stack. The research found that vulnerabilities disclosed per month more than doubled during 2026, increasing from 5,045 in January to 10,477 in July and reaching 10,740 in August. At the same time, the number of vulnerabilities observed being exploited also increased. GTIG recorded an average of 10.5 exploited vulnerabilities per month during 2025 compared with an average of 18 per month from January through August 2026. The research also found a smaller increase in zero-day exploitation, from an average of eight per month in 2025 to 11 per month during the first eight months of 2026. However, GTIG stresses that raw vulnerability counts do not tell the entire story. The organization's analysis indicates that AI-assisted vulnerability discovery is associated with a different risk distribution, including a higher proportion of moderate-risk vulnerabilities and a greater share of vulnerabilities resulting in remote code execution. ## Vulnerability Disclosures More Than Doubled in 2026 GTIG tracked vulnerability disclosures across 20 months from January 1, 2025, through August 31, 2026. The monthly number of disclosed vulnerabilities increased from 5,045 in January 2026 to 10,477 in July. August reached a new peak of 10,740 disclosed vulnerabilities. That increase does not necessarily mean every additional CVE represents an equally important security threat. GTIG points out that automated CVE assignment policies across some open-source ecosystems can significantly increase disclosure counts. As one example, vulnerabilities whose descriptions contained "Linux Kernel" generated approximately 5,000 CVEs between January and August 2026, while GTIG observed zero exploited in-the-wild zero-days among them. This distinction is important because vulnerability volume and operational risk are not the same measurement. ### High-Risk Vulnerabilities Also Increased GTIG found a notable increase in vulnerabilities classified as High Risk under its own vulnerability risk-rating system. High-Risk disclosures increased from 131 in January 2026 to 350 in August, representing 167% growth. Despite that increase, High-Risk vulnerabilities still represented only about 3% of all vulnerabilities disclosed in August. GTIG attributes the increase to two overlapping dynamics. First, the broader pool of affected vendors expanded. The research says baseline High-Risk disclosures increased from approximately 65 per month in mid-2025 to around 135 per month in mid-2026. Second, several vendor disclosure cycles produced unusually large numbers of vulnerabilities. GTIG highlights mass research disclosures affecting TOTOLINK consumer router firmware in April and May, which added 75 High-Risk flaws. It also points to Oracle's quarterly Critical Patch Update activity and Linux kernel network driver advisories during June, July and August. Together, these contributed 128 High-Risk vulnerabilities in August, according to GTIG. ### ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790848254862-info-1--187-.webp) ## Exploitation Is Increasing, but It Remains a Small Fraction of Disclosures GTIG recorded 141 distinct vulnerabilities that were both disclosed and exploited between January and August 2026. That number exceeded the 127 vulnerabilities exploited during the entire year of 2025. The average number of vulnerabilities exploited per month increased from 10.5 in 2025 to 18 during January through August 2026. However, GTIG emphasizes an important qualification: exploitation remains rare compared with the total number of vulnerabilities disclosed. Only 0.23% of vulnerabilities disclosed in 2026 were observed in active exploitation, or approximately one in every 431 disclosed vulnerabilities. This means monthly exploitation counts can be affected by factors such as vendor disclosure cycles and specific threat actor campaigns. GTIG also observed that since May 2026, vulnerability disclosure growth and exploitation growth have been moving at similar rates. The research reports indexed growth of 128% for disclosures and 127% for exploitation. According to GTIG, this suggests that exploitation is scaling alongside the broader vulnerability landscape rather than dramatically outpacing it. ## Zero-Day Exploitation Increased Only Marginally Zero-day exploitation showed a smaller increase. GTIG recorded an average of eight zero-days exploited per month in 2025 compared with 11 per month from January through August 2026. For much of 2026, the monthly count remained between eight and 12. In August, however, the number increased to 22. Despite this increase, zero-days still represent a very small portion of all vulnerabilities disclosed. At the same time, they accounted for 62% of all observed exploited vulnerabilities between January and August 2026. GTIG's analysis therefore points toward a different source for much of the growth in exploitation: vulnerabilities that had already been publicly disclosed. ## N-Days May Be Driving More of the Exploitation Growth GTIG suggests that threat actors may be finding it increasingly accessible or efficient to use AI and large language models to analyze software differences, patches, vulnerability disclosures and proof-of-concept material. This could potentially accelerate the weaponization of known vulnerabilities, or "n-days," after disclosure. GTIG describes this as a possible explanation for why exploitation has increased more substantially than zero-day activity. The research found that exploitation of High-Risk vulnerabilities increased from 28 in 2025 to 75 between January and August 2026. GTIG therefore identifies rapid weaponization of high-risk n-days as a primary contributor to the increase in exploitation observed during 2026. This is presented as an analytical assessment rather than proof that AI is responsible for every increase in n-day exploitation. ## Exploitation Remains Concentrated Around Important Attack Surfaces The distribution of exploited vulnerabilities also provides context for where organizations face exposure. GTIG found that vulnerabilities affecting edge and security appliances represented 14% of vulnerabilities exploited between January and August 2026. Enterprise directory and collaboration hubs accounted for another 11%. The research identifies edge gateways as an important initial-access surface. GTIG reports that more than 65% of exploited edge vulnerabilities during the period received High or Critical Threat Risk ratings. GTIG says adversaries are aggressively targeting unauthenticated public management interfaces, which it describes as a way to capitalize on enterprise EDR agent blind spots. The broader takeaway from the research is that while vulnerability disclosure numbers are expanding across the software ecosystem, observed exploitation remains concentrated around exposed enterprise services and perimeter technologies. ## AI-Assisted Vulnerability Discovery Is Showing a Different Risk Profile One of the central findings in the report concerns vulnerabilities discovered with the assistance of AI. GTIG cautions that publicly available data significantly undercounts AI-discovered vulnerabilities. One reason is that public CVE repositories do not currently provide standardized metadata identifying whether AI was involved in vulnerability discovery. Another is that cloud and SaaS providers can remediate AI-surfaced vulnerabilities directly in production without requesting CVE identifiers. Some findings can also remain undisclosed during coordinated vulnerability disclosure periods. To identify vulnerabilities likely discovered by autonomous agents, GTIG used a multi-tier verification process involving confirmed research disclosures, advisory and release monitoring, and attribution references to autonomous AI systems. The organization says this analysis points to a different risk distribution between AI-assisted and non-AI vulnerability discovery. GTIG Risk Rating CVEs Not Discovered by AI CVEs Discovered by AI Low 69% 39% Medium 28% 58% High 3% 4% **Source: Google Threat Intelligence Group, January-August 2026** The data shows that conventional vulnerability disclosures in GTIG's dataset were dominated by Low-Risk findings. Among AI-discovered vulnerabilities, the share of Low-Risk findings dropped to 39%, while Medium-Risk findings rose to 58%. GTIG says this may partly reflect how researchers use AI systems. Researchers can specifically direct autonomous agents toward critical infrastructure, sensitive privilege boundaries and complex code paths rather than using them for broad vulnerability scanning. GTIG also references similar findings from Mandiant's work with an [Agentic Vulnerability Discovery Harness](https://cloud.google.com/blog/topics/threat-intelligence/staying-ahead-of-adversarial-ai-through-agentic-source-code-review?e=48754805). ### ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790848291765-info-2--169-.webp) ## AI-Discovered Vulnerabilities Show a Higher RCE Share GTIG found another notable difference when looking at exploitation consequences. Exactly 50% of the AI-discovered vulnerabilities in its dataset resulted in remote code execution. Across the broader CVE ecosystem, the corresponding figure was 26%. The research also found that AI-discovered vulnerabilities represented a smaller share of Information Disclosure and Data Manipulation findings. Information Disclosure accounted for 8% of AI-discovered vulnerabilities compared with 18% among vulnerabilities not identified as AI-discovered. Data Manipulation represented 5% compared with 9%. GTIG says the concentration around code execution may be related to the way frontier AI systems are used in vulnerability research. The organization describes autonomous systems as capable of navigating complex, multi-step semantic code paths and synthesizing fuzzing harnesses and dynamic proof techniques. GTIG says these workflows can help identify memory corruption and logic bypasses in core libraries and runtimes. However, the organization also characterizes the evidence as an early indicator rather than an established long-term trend. ## A Real-World Example: CVE-2026-1731 GTIG highlights [CVE-2026-1731](https://www.hacktron.ai/blog/cve-2026-1731-beyondtrust-remote-support-rce) as an example of an AI-discovered vulnerability that was subsequently exploited. The vulnerability was an unauthenticated operating system command injection flaw affecting BeyondTrust Privileged Remote Access and Remote Support. According to GTIG, the vulnerability was discovered autonomously by a third-party research agent called Hacktron AI. After public disclosure, GTIG observed threat actors weaponizing the vulnerability in targeted initial-access campaigns. Within four days of public disclosure, GTIG observed one threat cluster exploiting the vulnerability. Five additional threat clusters were observed within the following seven days. GTIG says the observed post-exploitation activity included privilege escalation, data exfiltration and deployment of secondary payloads, including SNOWLIGHT, SPARKRAT and cryptominers. The case illustrates the compressed timeline that can emerge when vulnerability discovery and exploitation both become faster. ## AI Systems Are Also Becoming a Growing Vulnerability Target The report examines the other side of the equation. AI is not only being used to find vulnerabilities. The AI technology stack itself is becoming an increasingly important target for security research and exploitation. Across its January 2025 through August 2026 monitoring window, GTIG tracked 2,076 cumulative AI-related CVE disclosures. More than 1,500 of those vulnerabilities were identified between January and August 2026 alone, according to the research. GTIG grouped these vulnerabilities into eight architectural areas. AI Stack Layer 2026 Vulnerabilities Examples of Vulnerability Areas AI Orchestration & Agent Frameworks 782 RCE, command injection, unsafe workflow serialization, insecure tool calling, SSTI AI Web Apps & Portals 230 SSRF, stored XSS, local file inclusion Inference & Serving Infrastructure 212 Unauthenticated APIs, model deserialization, memory corruption, resource exhaustion Model Security Advisories 106 Prompt injection, system prompt exposure, guardrail bypasses, data poisoning ML Frameworks & Hubs 99 Memory safety flaws, malicious archive extraction, arbitrary file overwrites Frontier Models 97 RCE, command injection, sandbox escape, data exfiltration MLOps & Experiment Tracking 39 File overwrites, server takeover, artifact deletion Vector Databases & Search 19 Collection manipulation, RCE, query injection **Source: Google Threat Intelligence Group** ## AI Orchestration Frameworks Have Become a Major Chokepoint GTIG identifies AI orchestration and agent frameworks as the largest category in its 2026 dataset. The category accounted for 782 vulnerabilities. GTIG says orchestration middleware represented 50% of AI-related flaws and experienced a 347% increase in disclosures in 2026. The research highlights frameworks and tools such as Flowise, Langflow, LangChain, Dify, LlamaIndex, AutoGen, CrewAI, Semantic Kernel, Letta and MCP-related technology. According to GTIG, some visual workflow builders and autonomous frameworks use dynamic code execution capabilities to interact with their environments. This creates a security concern when untrusted workflow data, prompts or serialized configurations can reach execution functionality. GTIG describes scenarios in which attackers could potentially turn prompt injection or crafted workflow data into unauthorised code execution. ## AI Gateways Are Becoming a New Infrastructure Boundary GTIG also identifies centralized AI gateways as an important attack surface. At the application layer, compromised gateways can expose API credentials and private prompt streams. Those prompt streams may contain sensitive information, including personally identifiable information or proprietary source code. At the infrastructure layer, GTIG says compromised gateways can potentially provide attackers with an initial foothold for obtaining database credentials and moving into internal cloud environments. This creates a security relationship between the AI application layer and the underlying infrastructure. ## Inference Infrastructure Is Another Emerging Target GTIG recorded 212 vulnerabilities in inference and serving infrastructure during 2026. The category includes technologies such as vLLM, Ollama, LiteLLM, Llama.cpp, Triton, Ray, TGI, SGLang, TensorRT-LLM, BentoML and LocalAI. The report says nearly one-quarter, or 24%, of vulnerabilities in this category were associated with unauthenticated API endpoints or SSRF. According to GTIG, these weaknesses can create opportunities for remote access, GPU resource exhaustion or theft of model checkpoints, depending on the affected technology and vulnerability. The research therefore describes inference gateways as an increasingly important perimeter for AI infrastructure. ### ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790848531720-info-3--158-.webp) ## AI Middleware Is Already Being Exploited GTIG says it has not observed zero-day exploitation of AI infrastructure so far. However, newly disclosed vulnerabilities in exposed AI middleware are already being weaponized. The research identifies several examples that it rated High Threat Risk and that provide capabilities such as unauthenticated remote code execution, command injection or arbitrary file writes. ### CVE-2026-42271 - LiteLLM GTIG identifies CVE-2026-42271 as a command injection vulnerability affecting BerriAI LiteLLM. The issue involves MCP server preview endpoints and, according to GTIG, can result in host takeover and API credential theft. ### CVE-2026-5027 - Langflow CVE-2026-5027 involves path traversal and file writing in the Langflow `/api/v2/files` upload handler. GTIG says remote threat actors can use the flaw to place unauthorized files on the affected host, including cron jobs or SSH keys. ### CVE-2025-3248 - Langflow GTIG also identifies CVE-2025-3248, an unauthenticated Python code injection vulnerability involving the `/api/v1/validate/code` endpoint. According to the research, exploitation can result in immediate remote code execution. ## What the Findings Mean for Vulnerability Management GTIG expects vulnerability discovery and exploitation rates to continue increasing in the short to medium term. The organization says the cybersecurity community is still in the early stages of understanding AI-assisted vulnerability discovery and vulnerabilities affecting AI infrastructure. But several signals are already visible. AI systems are being used to investigate complex software. At the same time, organizations are deploying increasingly interconnected AI applications, orchestration layers, inference infrastructure and agent frameworks. This creates two related security challenges. **First, defenders may face a faster vulnerability cycle.** A vulnerability can move from discovery to public disclosure and exploitation within a compressed period. GTIG's CVE-2026-1731 example illustrates how quickly exploitation followed disclosure. **Second, organizations must secure the AI systems that are becoming part of their own infrastructure.** AI orchestration platforms, inference servers, gateways, MLOps systems and supporting frameworks introduce additional software components that need vulnerability management and access controls. The announcement highlights a broader industry shift toward vulnerability management that considers exploitability and operational context rather than simply counting disclosed CVEs. ## GTIG Calls for Threat-Intelligence-Driven Triage GTIG argues that organizations need to move away from unprioritized mass patching toward threat-intelligence-driven vulnerability triage. The report specifically points toward combining targeted edge defenses with automated and agentic remediation. The research also points to two defensive priorities. ### 1. Modernize vulnerability triage Organizations need mechanisms for prioritizing vulnerabilities based on threat intelligence, exposure and likely impact rather than treating every disclosed CVE identically. GTIG references Mandiant's separate work on AI-assisted vulnerability management as a framework for responding to compressed adversary timelines. ### 2. Use AI to find vulnerabilities before release For software providers, GTIG recommends proactive AI-enhanced code review. The objective is to identify and fix vulnerabilities before they reach production and become publicly exploitable. GTIG points to CodeMender, integrated into Google AI Threat Defense, as an example of an agentic defensive capability designed to continuously audit and patch code across developer workflows. The report suggests that broader adoption of pre-release AI-assisted code review could eventually help slow the growth of public vulnerability disclosures. That outcome remains a forward-looking assessment from GTIG rather than an established result. ## The Security Challenge Is Expanding in Two Directions The research presents a security landscape developing along two parallel paths. AI is becoming a tool for vulnerability research, potentially helping defenders uncover complex vulnerabilities that traditional approaches may miss. At the same time, attackers are targeting the software infrastructure that enables AI applications, including orchestration frameworks, inference systems, gateways, MLOps platforms and vector databases. The result is a vulnerability environment where discovery, disclosure and exploitation can increasingly overlap with the rapid development of AI infrastructure. For security teams, the practical challenge is therefore not simply managing a larger number of CVEs. It is understanding which vulnerabilities matter most, which systems are exposed, how quickly they are being exploited and whether AI-enabled infrastructure introduces additional attack paths. GTIG's findings indicate that AI-assisted vulnerability discovery is already showing a different risk profile in the analyzed dataset, while vulnerabilities affecting AI infrastructure are becoming a significant area of security research. The organization expects both vulnerability discovery and exploitation to continue growing in the short to medium term. The research ultimately points toward a security model built around faster vulnerability triage, stronger protection of exposed infrastructure, sandboxing of autonomous workloads and proactive testing of AI-enabled software before deployment. ## Original source https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era ## Tags `#Cybersecurity` · `#AI` · `#ThreatIntelligence` · `#Vulnerabilities` · `#CVE` · `#AISecurity` · `#ZeroDay` · `#VulnerabilityManagement` --- ## About this content This Markdown news article is the citation-grade twin of [Google Finds AI Is Reshaping Vulnerability Discovery and Exploitation](https://www.xcademia.com/news/google-finds-ai-is-reshaping-vulnerability-discovery-and-exploitation). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/google-finds-ai-is-reshaping-vulnerability-discovery-and-exploitation - Publisher: Xcademia, https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt