AI-found bugs aren’t proving any easier to exploit despite the hype
New research from security firm VulnCheck suggests that AI-assisted vulnerability discovery is not making bugs meaningfully easier for attackers to exploit, despite fears it would give criminals a major edge. The findings challenge the narrative surrounding Anthropic's Project Glasswing, which had warned that AI tools like Claude Mythos could enable attackers to hijack systems, steal data or disrupt operations at scale.
VulnCheck analysed 1,061 publicly attributed AI-assisted vulnerability discoveries from Project Glasswing and the Berkeley Vulnerability Research Initiative, finding just 14 (1.3 percent) had been confirmed as exploited in the wild — almost identical to the exploitation rate across all vulnerabilities generally. Of the 23,019 vulnerability candidates identified by Claude Mythos, only 126 have become published CVEs and just one has been confirmed exploited. VulnCheck researcher Patrick Garrity said the technology clearly has value for both attackers and defenders by increasing the volume of flaws found, but concluded that claims about frontier AI capabilities have been "overhyped relative to the evidence available today," adding that the impact "has been real but modest." Separately, VulnCheck recorded 495 known exploited vulnerabilities in the first half of 2026, with content management systems and network edge devices remaining common targets, while AI products themselves are increasingly being targeted by attackers.
In short
- Only 1.3% of AI-found bugs have been exploited in the wild
- Anthropic's Project Glasswing hype not matched by real-world attacks
- Researcher says AI's security impact is "real but modest," not overblown
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Whilst the current exploitation data is reassuring, drawing firm conclusions from early-stage technology development carries risks. The volume of AI-discovered vulnerabilities is increasing exponentially, and even stable exploitation rates may reflect defenders quickly adapting rather than true parity. As AI systems become more sophisticated and widely deployed, the attack surface could expand dramatically, making today's modest impact a poor predictor of future risks. Technological foresight sometimes requires acknowledging uncertainty rather than awaiting concrete crisis.
The case against
The empirical evidence from VulnCheck's substantial dataset of nearly 1,100 AI-assisted vulnerabilities demonstrates that the feared attacker advantage has not materialised in practice. When exploitation rates for AI-discovered bugs match the general baseline at 1.3%, this indicates the security community successfully adapts to new vulnerability types at comparable rates. Policy decisions should be grounded in actual evidence rather than speculative scenarios, and the current data suggests AI-assisted vulnerability research benefits both defenders and attackers proportionally rather than asymmetrically tilting advantage toward attackers.
Explained simply
Software vulnerabilities are security flaws in computer systems that attackers can exploit to steal data, disrupt operations or gain unauthorised access. As artificial intelligence has advanced, there has been growing concern that AI tools could discover these flaws at vast scale, potentially giving criminals a significant advantage.
These concerns were amplified by warnings from technology firms including Anthropic, whose Project Glasswing initiative cautioned that advanced AI systems could enable large-scale cyberattacks that would be difficult to defend against. The prospect of AI-powered vulnerability discovery has become central to discussions about the security risks posed by artificial intelligence.
Whether these concerns have materialised in practice is now a pressing question in cybersecurity circles. Understanding how AI discovery affects the real-world exploitation of vulnerabilities is important for assessing both the genuine risks and the hype surrounding artificial intelligence's role in cyber threats.