Expectations regarding the integration of artificial intelligence into cybersecurity were mixed: some feared AI would become the primary weapon for hackers, while others hoped it would serve as a shield for developers. Statistics from the first half of 2026 have clarified the situation: the boom in bug detection using neural networks did not lead to the expected wave of attacks. On the contrary, developers have learned to find and patch holes faster than malicious actors can exploit them.
Explosive Growth in Vulnerabilities Without a Rise in Attacks
According to an analysis by VulnCheck, the use of AI tools has indeed led to a sharp increase in the number of identified code issues. The US National Vulnerability Database (NVD) registered 45,207 software vulnerabilities between January 1 and July 27, 2026. This number is nearly equal to the total for the record-breaking year of 2025. If current trends continue, the final annual figure could double compared to the previous year.
However, contrary to fears, the number of actual cyberattacks is not growing proportionally. Out of 1,061 vulnerabilities detected with the help of AI, only 14 cases had confirmed exploitation by malicious actors — just 1.3%. This rate is consistent with the average for all other vulnerabilities, rather than being higher.
Corporate Surge: Oracle and Microsoft
The increase in bug-hunting activity is also evident at the level of specific tech giants. In its July update, Oracle fixed 1,449 vulnerabilities, almost five times the 309 errors fixed a year earlier. Microsoft also recorded record numbers, closing 622 issues, and specifically noted the contribution of artificial intelligence tools to their discovery.
Throughout the first half of 2026, VulnCheck recorded 495 known cases of vulnerability exploitation. Meanwhile, the number of published CVE entries grew by 45%, while the number of vulnerabilities actually used in attacks increased by only 10%. The share of CVEs becoming part of attacks dropped to 1.4%, down from a peak of 2.7% recorded at the end of 2023.
The Glasswing Project Paradox
Particular interest lies in the analysis of Anthropic's Glasswing project, which became one of the most prominent examples of using AI for bug hunting. In May, Anthropic reported that the Claude system discovered 23,019 potential issues. However, VulnCheck data paints a different picture: the project's public log stopped growing after the initial 1,611 entries. Of these, only 126 received official CVE identifiers, and only one vulnerability saw confirmed exploitation in real-world attacks.
VulnCheck experts believe the main effect of AI is that developers have become more efficient at finding bugs in their own software. Many fixes, for instance in the Chrome browser, are based on internal Google checks rather than external reports. A vulnerability found and fixed by the manufacturer before publication does not become available to malicious actors.
Accelerated Threats and New Targets
Despite positive trends, the threat remains relevant. The average time between the publication of a vulnerability and its first use has decreased: the median value dropped from 120 days in 2025 to 80 days in the first half of 2026. The US Cybersecurity and Infrastructure Security Agency (CISA) already recommends that organizations apply patches within 3 days for critical vulnerabilities with confirmed exploitation.
Furthermore, AI itself is becoming a new target for attacks. VulnCheck identified 28 known exploited vulnerabilities in AI systems, 10 of which have already been used by malicious actors. Examples include attacks on the LangFlow platform, where a series of errors allowed access to data, including credentials for services like OpenAI and Claude. Following this, attackers launched miners and attempted to spread within the infrastructure.
So far, data shows that AI has significantly increased the speed of software bug detection but has not created a confirmed advantage for attackers. The primary effect of such tools at this stage is that developers gain the ability to find and close vulnerabilities faster before they can be exploited.
