> ## Content Index
> Fetch the complete content index at: https://globalfeed.ai/llms.txt
> Use this file to discover other available public pages before exploring further.

# AI-assisted bug hunting pushes CVE count to a record, Microsoft patches 974
- URL: https://globalfeed.ai/en/ai-assisted-bug-hunting-pushes-cve-count-to-a-record-microsoft-patches-974/
- Published: 2026-09-21T22:07:19.000Z
- Updated: 2026-09-21T22:07:19.000Z
- Description: cve.icu has logged 66,401 CVEs so far this year, roughly double the 33,512 recorded by the same date last year.
- Author: GlobalFeed Editor
- Tags: cybersecurity, CVE, Microsoft, x-WIRED, x-JGamblin, dil-en

The number of software flaws found with the help of AI has surged in recent months, adding pressure on understaffed security teams and on volunteers who maintain open source projects, WIRED reports.

The figures: Microsoft said last week it had shipped patches for 974 CVEs so far this month, a record. Oracle released 1,448 patches in July, against 309 in July 2025\. Google Chrome's two major releases in June included 1,072 patches, more than the fixes in the previous 23 big releases combined. Mozilla said in April it had found 271 vulnerabilities in Firefox during a single bug hunting sprint that used Anthropic's Mythos model.

According to cve.icu, the analysis project run by Jerry Gamblin, head of research at Empirical Security and founder of RogoLabs, 66,401 CVEs had been recorded as of Wednesday this week. By September 16 last year the same tally stood at 33,512\. In all of 2022, the year OpenAI launched the first version of ChatGPT, cve.icu logged 25,000 CVEs.

## More CVEs, more exposure?

Gamblin does not think the spike is overblown, but he rejects the idea that the number itself is the damage. "More CVEs is not more vulnerability," he says. "It's more known vulnerability, which is mostly the system working."

The worry is that discovery outpaces patching: developers falling behind, users unable to update fast enough, and attackers using AI to find novel flaws on their own. As Britain's National Cyber Security Centre puts it, "Just finding vulnerabilities does nothing to improve your security."

For now researchers describe a fragile balance between AI speeding up bug discovery and AI helping defenders. Attackers, like the industry, are still working out where to apply AI, says Matthew Olney, director of threat intelligence at Cisco Systems. Gamblin sums up the gap: "Discovery scales with compute. Remediation scales with people, and people are the part you can't buy more of in a quarter."

Full story at [WIRED](https://www.wired.com/story/kernel-panic-ai-vulnerability-explosion/?ref=globalfeed.ai).