AI Is Doubling the Pace of Vulnerability Discovery, and Attackers Are Keeping Up

Google Threat Intelligence Group (GTIG) has analysed vulnerability data to measure how artificial intelligence is changing the threat landscape. Its findings show that AI is changing not only the speed of discovery and exploitation, but also the kinds of vulnerabilities being found. Disclosures per month doubled, rising from 5,045 in January 2026 to 10,477 in July, and then to 10,740 in August 2026.

Exploitation is rising too. The number of vulnerabilities exploited averaged 10.5 per month in 2025, but averaged 18 per month from January to August 2026. Zero-day exploitation, where attackers use a flaw before a fix exists, grew more modestly, from an average of 8 per month to 11. GTIG also found that AI-assisted discovery turned up proportionally fewer low-risk flaws, more moderate-risk flaws, and more flaws that lead to remote code execution (RCE). Note that GTIG uses its own risk ratings in this research, not CVSS severity scores.

GTIG expects discovery and exploitation to keep growing in the short to medium term. Its advice is that organisations move away from unprioritised mass patching and towards triage driven by threat intelligence, combined with targeted defence of internet-facing systems and automated, agentic remediation. This summary is based on the opening of the report, so it does not cover the full analysis.