Google Says AI Is Reshaping Vulnerability Discovery and Exploitation

Google Threat Intelligence Group says artificial intelligence is changing both the volume and character of software vulnerability discovery. Its analysis found that monthly disclosures rose sharply during 2026, while exploitation activity increasingly focused on rapidly weaponizing already disclosed flaws rather than producing a broad wave of new zero-days.

Disclosure and exploitation volumes increased

Google reported that monthly vulnerability disclosures rose from 5,045 in January to more than 10,000 in July and August. The group also counted 141 vulnerabilities exploited in the wild during the first eight months of 2026, exceeding the total it recorded for all of 2025.

The researchers said AI-assisted analysis may help attackers compare patches, product versions, advisories and proof-of-concept code to accelerate n-day exploitation. At the same time, autonomous research tools are finding security defects, including high-impact flaws in exposed enterprise products.

Patch prioritization must account for shrinking windows

Defenders should not interpret higher disclosure totals as equal risk across every CVE. Internet exposure, exploitation evidence, privileges gained and available mitigations remain decisive. Asset owners need rapid identification of vulnerable edge systems and a tested emergency-patching path. SectechMedia follows related operational guidance in its cyber-physical security coverage.

Sources

• Google Threat Intelligence analysis — September 30, 2026
• The Record report — September 30, 2026