Exploring the Risks and Impacts of AI on Vulnerability Discovery and Exploitation
As we hear a lot of noise about AI’s impact on vulnerability discovery and exploitation, I found the need to compartmentalize the risks. So, I took it upon myself to build categories that provide a mental framework for the risks, impact, and evidence AI poses for vulnerabilities and exploitation. Most of these risks aren't new. AI makes the capabilities behind each one more accessible and accelerates how quickly attackers can use them.
The Five Risk Categories for AI Vulnerability & Exploitation:
- Vulnerability Discovery - AI has made it easier to find new vulnerabilities.
- Vulnerability Exploitation - AI has made it easier and faster to develop and weaponize vulnerabilities.
- Attack Orchestration - AI has made it easier to orchestrate automated campaigns leveraging vulnerability exploitation.
- Attack Surface - AI tooling has expanded the attack surface, creating new exposure for enterprises.
- Categorical Risk - Frontier labs have raised categorical risk concerns, from model breakouts to self-replicating AI.
AI-Assisted Vulnerability Discovery
A growing risk category is AI-assisted vulnerability discovery: AI tools, including frontier models and purpose-built harnesses for finding vulnerabilities, have become accessible to the masses, requiring less skill and making it much easier to discover software vulnerabilities. This accessibility isn't limited to defenders. Attackers have the same capabilities at their disposal, allowing them to discover and exploit new zero-days and expand the pool of viable targets.
The evidence for this shift is mounting. The increase in vulnerability reports to open source projects on GitHub was one of the first indicators that something was changing, as newer frontier models became available. We've seen this firsthand: VulnCheck's Report a Vulnerability service has seen a 10x increase in submissions from researchers over the past year, with 51% of submissions self-reporting that the vulnerability was found using AI. Most notably, we've seen 100% YoY CVE growth that appears to be driven by a combination of AI tooling for vulnerability discovery and expanded CNA capacity. Furthermore, initiatives have sprung up to act as clearinghouses for AI-discovered vulnerabilities, including Patch the Planet, Project Glasswing, Athena, Akritis, Gold Eagle, and others.
Vulnerability Exploitation
In addition to making vulnerabilities easier to discover, it has also become easier to build and test functional exploits, leting attackers move faster. In the first half of 2026, we saw the median time from CVE publication to KEV fall from 120 days in 2025 to 80 days, as we highlighted in the 1H-2026 state of exploitation report.
Historically, the number of CVEs exploited has stayed at a relatively predictable rate with CVE issuance. So, as more CVEs are published, it’s likely a similar percentage, between 1.5-2%, will be observed being exploited in the wild over time.
This chart looks at cohorts of CVEs based on the year they were published over the past four years, and plots the cumulative percentage of those CVEs with exploitation evidence against the time elapsed since publication. The 2026 cohort appears to be tracking at a similar rate as previous year cohorts meaning the growth of known exploited vulnerabilities is growing in-line with CVE growth, and it will be interesting to see if that trend continues. There continue to be more needles in a bigger haystack. It would be wise to plan for attackers to move faster and expand targets with additional AI capabilities at their disposal. I plan on digging into this further in a future blog post.
Attack Orchestration
Attack orchestration is nothing new for threat actors. Many actors have long used available tooling and scripts to automate their campaigns and that is the majority of activity we still observe today. The reality is that AI makes the capabilities to build automated attack campaigns much more broadly accessible, and it enables existing actors to move faster. Attackers are also now experimenting with and operationalizing AI agents to expand their operations, which is where much of the hype around the term “agentic” comes from.
Dutch Institute for Vulnerability Disclosure Incident
On September 21, 2026, a malicious actor managed to breach the Dutch Institute for Vulnerability Disclosure using two zero-day vulnerabilities (CVE-2026-102489, CVE-2026-102490) in their Zammad ticketing system.
The use of agents was evident for a number of reasons, including:
- “The sheer volume of the attack and the number of artifacts generated, in a relatively short period.”
- “The fact that attack scripts are commented and documented, and that the attack agents seem to be talking to each other in the comments of the scripts.”
The agents’ activity was captured by DIVD monitoring and a snippet can be seen here:
Norforge visibility into Cairn’s AI-Driven Cyber Operations
On October 16, 2026, Norforge published research into Cairn’s AI-Driven Cyber Operations. Cairn is an AI Autonomous Pentesting agent that Norforge discovered publicly exposed control panels, whichexposed threat actors using Cairn for financially motivated operations,including verifying externally exposed assets, finding unauthenticated RCE vulnerabilities, and obtaining shell access with an average success rate of 10%. This also is a reminder that any cybersecurity tooling available to defenders is also likely to end up in the hands of a threat actor.
Palo Alto Unit 42: AI-Powered Espionage Campaign
On October 15, 2026, Palo Alto Unit 42 published research on a campaign targeting government Linux infrastructure, which they track as CL-UNK-1211. The attackers used web shells, credential harvesting, and a custom RAT, and some of the PHP and shell scripts they relied on for persistence, reconnaissance, and data exfiltration appear to be AI-generated. Unit 42 inferred this from conversational, step-by-step comments left in the scripts, which suggest the code was either pasted from an LLM or run by an automated agent. This largely aligns with other evidence we've seen of AI being used as a tool to help attackers build out their campaigns.
We have to assume attackers will leverage the same capabilities available to defenders.
Expanded Attack Surface
In the 1H-2026 state of exploitation report, we also highlighted AI technology becoming a top 5 category for attackers, and we have seen this trend continue. AI products and services have been deployed at an incredibly fast rate. Additionally, these deployments often require broad access to data across the enterprise, making many of these products an excellent target for attackers. Organizations often expose services such as AI routers, MCPs, and other AI infrastructure on the internet, intentionally or not. This provides new exposure, leading to an expanding attack surface. Langflow is one of the best examples of AI exposure, with 15 vulnerabilities targeted just this year.
Categorical Risk
Categorical risks are the ones that tend to make the headlines, and the hype usually starts with the frontier labs themselves. Model breakouts and self-replicating AI have both been raised as concerns. OpenAI called its Hugging Face incident a "warning shot" after its models, during an internal cyber evaluation, got out of their isolated environment and compromised Hugging Face's systems. Anthropic found three cases where its models reached real systems from an evaluation environment, and its research on self-replicating AI suggests small models may be only months away from replicating across cheap IoT devices.
The reality is that these risks could have an impact, but the incidents also point to gaps in security controls and detection. In both cases, the models were running in evaluation environments without the safeguards and monitoring. Anthropic's incidents came down to a misconfiguration that left internet access open. OpenAI acknowledged its monitoring wasn't running on these evaluations and that early warning signs were missed. To be fair, OpenAI's models also chained together previously unknown vulnerabilities to get out, so this wasn't only a misconfiguration. Still, adequate security controls could have contained the model breakouts that led to hacking events, and operators should be responsible for the technology they deploy and operate.
This highlights that these models' capabilities are real, and defense-in-depth measures are wise. It also reinforces that organizations implementing AI have a responsibility to build adequate detection and response capabilities around the models and agents they deploy.
AI Amplified Risk
Most of these risks aren't new. What AI changes is how accessible the capabilities are and how quickly attackers can act on them. Here's how I'd think about each of the five categories:
- Vulnerability Discovery - More vulnerabilities are being found, by defenders and attackers alike. Expect CVE volume to keep growing, identifying vulnerabilties and prioritize based on threat indicators and evidence of exploitation rather than volume alone. Consider optimizing your patch strategy with automation.
- Vulnerability Exploitation - Exploitation appears to be getting faster, with the median time from CVE publication to KEV falling to 80 days. The percentage of CVEs exploited hasn't grown with CVE volume, so there are more needles in a bigger haystack. It would be wise to plan for shorter response windows and implement mitigating controls where possible.
- Attack Orchestration - Automation is nothing new, but AI agents are lowering the barrier to building and running campaigns. The evidence is still early, and in several cases the use of AI is inferred from artifacts rather than proven. Detection and response matter more than the hype as AI powered attacks are often noisey.
- Attack Surface - This is the category where AI itself becomes the target. Exposed AI tooling is already being exploited, and these systems often hold privileged access to enterprise data. Know what AI infrastructure you're exposing and treat it like any other internet-facing system.
- Categorical Risk - The capabilities frontier labs have highlighted are real, but the incidents point to gaps in security controls and detection. Defense in depth is wise, and operators need to be responsible for the technology they deploy.
About VulnCheck
VulnCheck is helping organizations not just to solve the vulnerability prioritization challenge - we’re working to help equip any product manager, CSIRT/PSIRT or SecOps team and Threat Hunting team to get faster and more accurate with infinite efficiency using VulnCheck solutions.
We knew that we needed better data, faster across the board, in our industry. So that’s what we deliver to the market. We’re going to continue to deliver key insights on vulnerability management, exploitation and major trends we can extrapolate from our dataset to continuously support practitioners.
Are you interested in learning more? If so, VulnCheck's Exploit & Vulnerability Intelligence has broad threat actor coverage. Register and demo our data today.