Vulnerability Disclosures Surge as AI Digs Through Old Code

Microsoft's September release included 975 vulnerability advisories, and this month's release contained 1,415. Before June, the average was around 100 a month. Cisco Talos says the jump follows the arrival of frontier AI models, including one called Mythos, that are better tuned to finding vulnerabilities.

According to Talos, most of these flaws sit in older code from high-profile products and systems. AI is working through a backlog of technical debt in libraries and tools that many environments rely on. Talos stresses that disclosure does not equal weaponisation: a published vulnerability is not the same as one being actively exploited. Even so, older tools have long been attractive targets because attackers know them well and can predict what is likely to be present in a network. The log4j flaw (CVE-2021-44228) is a reminder. The library was in nearly every environment but rarely appeared in visibility scans, so defenders scrambled just to learn whether they used it.

The volume is also straining security vendors. Talos works with large vendors such as Microsoft through programs like the Microsoft Active Protections Process (MAPP), receiving guidance on flaws most likely to be exploited so detection coverage is ready when advisories are published. Talos says it has had to invest more resources to keep up with notifications arriving quickly, often on staggered or out-of-band timelines.