Welcome to the inaugural version of Kernel Panic! A weekly publication by Lily Hay Newman and Matt Burgess from inside the brand new world of privateness and digital safety. To obtain this article in your inbox every week, sign up here.
AI doomers have lately traded one worst-case situation for one more, placing apart a possible software vulnerability apocalypse to concentrate on the potential for rogue AI inflicting mass human death within the subsequent decade. As AI leaders think about a cooperative slowdown on frontier mannequin improvement, although, one side of the cybersecurity sea change has already arrived due to present, broadly obtainable capabilities in mainstream AI merchandise, together with open weight fashions.
A tidal wave of vulnerabilities uncovered using AI has solely accelerated in current months—piling extra stress on under-resourced, and really human, IT and safety groups and straining volunteers who keep essential open supply software program. Researchers discovered and disclosed an enormous array of vulnerabilities earlier than the rise of AI-enhanced bug searching as nicely, however the current surge is obvious.
Microsoft stated final week that it has issued patches for 974 CVEs to date this month, setting a brand new report. (CVEs, or frequent vulnerabilities and exposures, is cybersecurity jargon for confirmed software program flaws.) In July, Oracle shipped 1,448 patches in comparison with 309 in July 2025. Google Chrome’s two main model releases in June included 1,072 patches, more than all the vulnerability fixes shipped within the prior 23 huge releases mixed. And Mozilla stated in April that it discovered 271 vulnerabilities in Firefox during one bug hunting sprint utilizing Anthropic’s Mythos mannequin.
Throughout the board, there have been a surprising 66,401 CVEs recorded as of Wednesday this week, in accordance with Jerry Gamblin, the pinnacle of analysis at Empirical Safety and founding father of RogoLabs, which runs the CVE evaluation venture cve.icu. By September 16 final yr, cve.icu had logged a complete of 33,512 CVEs—virtually half the present complete. For all of 2022, the yr OpenAI launched its first model of ChatGPT, cve.icu recorded 25,000 CVEs.
Amongst each safety and AI researchers, consultants have been divided about whether or not this spike and different impacts of AI on cybersecurity might be catastrophic or as an alternative enlarge present dynamics and challenges. Some have identified that gradual patch adoption and lagging funding in cybersecurity broadly already gave attackers many benefits that led to hacking disasters earlier than the rise of AI. However as vulnerability discovery numbers have continued to rise, and the dialogue has change into much less theoretical, the 2 sides have appeared to maneuver a bit nearer.
“I don’t suppose it’s overblown,” Gamblin says of the obvious explosion in vulnerability findings throughout the trade. “What I’d push again on is the concept that an even bigger quantity is itself the hurt. Extra CVEs will not be extra vulnerability. It is extra identified vulnerability, which is generally the system working.”
The concern, although, is that huge vulnerability discovery will imply builders getting outpaced on patching, software program customers who can’t patch quick sufficient, and an array of escalating cyberattacks fueled by extra attackers discovering novel vulnerabilities on their very own utilizing AI. As Britain’s Nationwide Cyber Safety Middle puts it, “Simply discovering vulnerabilities does nothing to enhance your safety.”
