Vulnerability Disclosures Surge in 2026 Driven by AI-Assisted Exploitation
Google’s Threat Intelligence Group (GTIG) reported that vulnerability disclosures doubled between January and August 2026, reaching a peak of 10,740 in August alone. This marks a significant increase from the 5,045 disclosures recorded in January, with monthly totals exceeding 10,000 for both July and August. The surge reflects not only a higher volume of bugs being found but also a shift in how threat actors discover and exploit them.
AI Accelerates Weaponization of Known Vulnerabilities
According to GTIG researchers, artificial intelligence is measurably changing not just the pace of vulnerability discovery and exploitation, but also the types and risk profiles of vulnerabilities being targeted. The increase is driven less by a flood of new zero-days and more by the rapid, targeted weaponization of high-risk exploits in the wild.
Zero-days are vulnerabilities exploited before vendors are aware of them, while n-days refer to flaws that have been patched and publicly disclosed. GTIG found that hackers are increasingly using AI to analyze patches, version differences, disclosure announcements, and proof-of-concept code to quickly weaponize n-days.
"It is possible that threat actors are finding it more accessible or efficient to use LLMs and AI tools to automate analysis of differences between product versions, patches, vulnerability disclosure announcements, and Proof-of-Concept (POC) code to rapidly weaponize n-days, rather than to discover new zero-days,"
— Google Threat Intelligence Group researchers
Case Study: CVE-2026-1731 Demonstrates AI-Driven Exploitation Speed
As an example, Google cited CVE-2026-1731, a vulnerability in BeyondTrust software that was autonomously discovered by a third-party research agent called Hacktron AI. The flaw was disclosed in February 2026 and quickly exploited in the wild.
Within four days of public disclosure, GTIG observed a threat cluster actively exploiting the vulnerability. Within seven days, five additional threat clusters had begun leveraging the same flaw in targeted initial-access campaigns designed to bypass enterprise perimeter defenses.
These threat actors conducted a range of post-exploitation activities, including privilege escalation, data exfiltration, and the deployment of secondary payloads such as SNOWLIGHT, SPARKRAT, and cryptominers.
AI Agents Focus on Medium and High-Risk Flaws
Kelli Vanderlee, senior analyst at GTIG, explained that AI agents are primarily being used to find medium and high-risk vulnerabilities. A bug is classified as high-risk if its exploitation enables attackers to have a notable, direct impact on the security of targeted devices and networks without needing to bypass major mitigating factors.
"Reliability of exploitation is expected to be high and can typically be done on a wide scale," Vanderlee added, noting that the ease and scalability of AI-assisted exploitation are key drivers of the trend.
Exploitation Trends Concentrate on Enterprise Perimeter Devices
GTIG’s report notes that threat actors continue to focus exploitation efforts on perimeter appliances and exposed enterprise services. Between January and August 2026, 14% of exploited vulnerabilities affected edge and security appliances.
Many of the vulnerability disclosures this year have originated from a small group of vendors, including router firmware provider Totolink and Oracle. This concentration highlights specific attack surfaces that are under heightened scrutiny from both defenders and attackers.
Broader Context: CVE Volume Continues to Rise
The GTIG findings align with data released the previous week by the Cybersecurity and Infrastructure Security Agency (CISA), which reported that more than 67,000 new CVEs had been published in 2026 by mid-year. Experts project a total of 96,000 new CVEs by the end of the year.
The National Institute of Standards and Technology’s National Vulnerability Database program also reported a 263% increase in annual CVE submissions between 2020 and 2025. Submissions in the first three months of 2026 were one-third higher than during the same period in 2025, according to CISA.
GTIG warned that AI-assisted vulnerability discovery and exploitation is expected to continue growing in the short to medium term, as threat actors leverage automation to accelerate the time between disclosure and active exploitation.
Source: The Record