Is AI accelerating the discovery and exploitation of software vulnerabilities?
Core argument: Disclosures of common vulnerabilities and exposures (CVEs) accelerated sharply in 2026 after years of steady increases, with monthly reports running at several times their 2025 levels, and high-severity and critical vulnerabilities rising rapidly as well.
We are entering what some call The Hackening, a period of radical technological instability where systemic frailties are everywhere. You can see it everywhere. For example, the Port of Los Angeles recently reported more cyberattacks per month than it saw in entire years before 2020. This might be less worrisome if the number of reported software vulnerabilities was not exploding. But it is. After years of steady increases, disclosures of common vulnerabilities (CVEs) accelerated sharply in 2026, with monthly reports now running at several times their 2025 levels. This is not simply an explosion in AI helping detect minor software defects. High-severity and critical vulnerabilities are increasing rapidly as well. Sure, there are caveats about changing reporting practices and the role of AI in these numbers (detection slop?). But the broader picture is deeply unsettling, as the PHP security disclosure made clear.


