VulnCheck: 51% of vulnerability reporters say AI found the flaw
VulnCheck sorts AI's effect on vulnerability work into five categories and finds most of the risk is old risk arriving faster.
· VulnCheck · Research by Patrick Garrity
VulnCheck's Patrick Garrity reports that 51% of researchers submitting to its disclosure service say AI found the bug, with submissions up tenfold in a year. The share of CVEs exploited in the wild has not risen.
01What happened
VulnCheck published Patrick Garrity's analysis of AI's effect on vulnerability discovery and exploitation on October 22, 2026. Garrity groups the risk into five categories: discovery, exploitation, attack orchestration, attack surface and categorical risk. He draws on VulnCheck's own disclosure service, its KEV tracking and published incident reports.
02How it works
Discovery is where the measured change is largest. Submissions to VulnCheck's Report a Vulnerability service rose tenfold over the past year, and 51% of submitters said AI found the vulnerability. CVE volume grew 100% year over year, which Garrity attributes to AI tooling and to expanded CNA capacity. Exploitation timelines shortened while the proportion of CVEs ever exploited stayed flat, so the result is more candidates rather than a higher hit rate.
03Who is affected
Exposed AI infrastructure is the attack surface Garrity singles out: routers, MCP servers and agent platforms that sit on the internet while holding privileged access to data. He notes that Langflow alone had 15 vulnerabilities targeted this year. Teams running internet-facing AI tooling carry the new exposure, rather than teams whose AI use stays internal.
04What to do
Rank vulnerabilities by exploitation evidence rather than by volume, and automate patching where you can. Inventory which AI tools face the internet and treat them as exposed systems, with monitoring and containment built around models and agents.
Measured results
Median days from CVE publication to KEV listing
Lower means attackers reach exploitation sooner
| Result | Score |
|---|---|
| 2025 | 120days |
| 1H 2026this story | 80days |
Scale 0 to 120days · Source: vulncheck.com, as published
Questions people ask
- Does AI actually make more vulnerabilities get exploited?
- VulnCheck reports no rise in the exploited share: historically about 1.5 to 2% of CVEs are exploited in the wild, and the 2026 cohort tracks similarly to earlier years. Patrick Garrity frames the problem as more needles in a bigger haystack, because CVE volume grew 100% year over year while the exploitation rate held steady.
- How fast do vulnerabilities reach CISA's KEV catalog now?
- Median time from CVE publication to a KEV listing fell from 120 days in 2025 to 80 days in the first half of 2026, VulnCheck reports in its 1H 2026 exploitation review. The advice Garrity draws from that: plan for shorter response windows, and apply mitigating controls wherever patching lags behind the pace.
- Which AI systems does VulnCheck say are most exposed?
- Internet-facing AI infrastructure is VulnCheck's answer: routers, MCP servers and agent platforms that hold privileged access to data. Garrity points to Langflow, which had 15 vulnerabilities targeted this year, and recommends inventorying which AI tools face the internet, then treating each one like any other exposed system.
Sources 2 links, all fetched
- 1vulncheck.comVulnCheck Analysis
- 2vulncheck.com1H 2026 Exploitation