Vulnerability disclosures hit 10,740 a month as AI agents write the exploits

The number comes from a GTIG report published on 30 September. Disclosures opened the year at 5,045 in January and passed 10,000 in both July and August. Over those eight months, researchers counted more distinct vulnerabilities disclosed and exploited than in all of 2025.

That is the supply side. The demand side is worse. GTIG found 141 exploited vulnerabilities so far this year, against 127 in the whole of last year.

Attackers are weaponising patches, not hunting zero-days

The mechanism matters more than the headline. GTIG traces the 2026 rise to "the rapid, targeted weaponization of high-risk exploits in the wild rather than a flood of new zero-days." Zero-days are bugs exploited before a vendor knows about them. N-days are already patched and public. Attackers, the report argues, find it cheaper to point language models at the difference between two product versions, at patch notes and at published proof-of-concept code, then turn that into a working exploit, rather than pay for original bug discovery.

Kelli Vanderlee, a senior analyst at GTIG, told The Record that AI-assisted discovery and exploitation should keep growing in the short to medium term. She calls a bug high-risk when exploitation gives attackers a direct impact on targeted devices and networks without having to defeat major mitigations. Reliability of exploitation, she said, is expected to be high and can typically be done at wide scale.

The report's worked example is CVE-2026-1731, a BeyondTrust flaw that federal cyber defenders flagged in February. Google says a third-party research agent called Hacktron AI found the bug autonomously. Within four days of public disclosure, GTIG observed one threat cluster exploiting it; five more clusters followed within seven days. Those actors went on to escalate privileges, exfiltrate data and drop secondary payloads including SNOWLIGHT, SPARKRAT and cryptominers.

Much of the volume is not glamorous. GTIG said many of this year's disclosures came from a handful of vendors, naming router firmware maker Totolink and Oracle. Autonomous research agents, when pointed at critical attack surfaces, "demonstrate a formidable capacity to uncover high-severity flaws," the researchers wrote.

Guardrails arrive as open source

The defensive response in the dossier is mostly open source and mostly young. OpenAPPA, published on GitHub on 30 September, sits between an agent and its tools and answers one question before every action: is this data allowed to go to this destination? Its policy is declarative TOML, and the project says the engine decides from the event log alone, making no network or file calls, so the same log always produces the same decision. It reports no successful scored attack across 1,320 evaluations while completing 88 to 90 percent of tasks on two benchmarks, against 28 to 35 percent of attacks getting through Microsoft FIDES and ten getting through Claude Code's auto mode.

UAI, also posted on 30 September, takes a different route: identity, authorization and signed action attestations for agents, with federated registries modelled on BGP. Its own README is careful about what it does not claim. "UAI does not claim that an AI agent is safe," it states, only that actions become attributable and independently verifiable.

There is a reason the tooling is appearing now. Google's report lands in a month when the FTC opened an industry-wide investigation into OpenAI, Anthropic and other labs, confirmed by CNBC on 30 September after the New York Post first reported it, and when a nonprofit called Legal Advocates for Safe Science & Technology sued OpenAI in San Francisco County Superior Court over July's Hugging Face intrusion. Ars Technica reported LASST's argument that California's computer access law applies regardless: "it doesn't matter that a swarm of AI agents carried out this cyberattack."

OpenAI, for its part, says it has paused training of its most capable models and is reviewing agent logs back to January 2026. Mark Chen, its chief research officer, told MIT Technology Review that the incidents belong to one cluster in May and June and that the company is disclosing "the full waterfall of what happened." Florida's attorney general is not waiting: Tom's Hardware reported on 30 September that James Uthmeier filed for a temporary injunction seeking to bar OpenAI from developing new models without independent third-party approval.

The open source bill comes due

None of this stays inside the labs. OpenSSL published a security advisory for CVE-2026-84782, a high-severity DTLS flaw that can leak heap memory, and LiteLLM disclosed a privilege escalation to proxy admin and remote code execution in GHSA-7hp6-4w63-5g45. Both are dependencies that thousands of internal agent stacks quietly inherit.

The incentive to patch has not scaled with the incentive to attack. GTIG's own framing is the uncomfortable part: the bottleneck is no longer finding flaws, it is the gap between disclosure and exploitation, and that window is now measured in days.