EFF says Frontier AI is driving faster vulnerability discovery

The Electronic Frontier Foundation warned that discovering severe software vulnerabilities is no longer costly, difficult work requiring years of training and deep knowledge, and that multiple potentially internet-breaking flaws were disclosed and patched during October’s final two weeks in open-source software underpinning much of the internet. Major vulnerabilities capable of crippling the entire internet previously occurred only every few years, according to EFF. The group attributes the acceleration to frontier AI models from OpenAI and Anthropic, which make finding zero-days in open- and closed-source code cheap and easy. EFF says researchers found three percent of all software vulnerabilities ever discovered in the history of software during October alone.

EFF also states that researchers have found nearly a quarter of every software security issue ever discovered this year alone. The group warns that data breaches may now be more likely, websites may experience more attacks than usual, and some services may face disruption. Some favorite websites were down for a bit during the October vulnerability activity, EFF notes. The organization calls for a bigger conversation about corporations contributing to open-source upkeep and regulating big tech, while framing immediate personal protection as digital hygiene.

ThreatDown reports that September 2026 Patch Tuesday saw 998 addressed common vulnerabilities and exposures, compared to 96 from the prior-year period. The firm’s Oct. 12, 2026 blog post stated those same figures. Patched Linux kernel vulnerabilities averaged three times higher over three months than a year earlier, ThreatDown says. Google’s Chrome browser saw vulnerability patches rise 36-fold.

ThreatDown credits advanced AI models such as Anthropic’s Claude Mythos Preview, introduced in April 2026, with driving much of the increase in vulnerability discovery. ThreatDown says Anthropic’s Claude Mythos Preview is used in Project Glasswing to find vulnerabilities in critical software, alongside Microsoft, the Linux Foundation and other groups. The firm warns that vulnerability discovery is accelerating faster than organizations can deploy fixes. Verizon’s 2026 Data Breach Investigations Report found that 35% of known actively exploited vulnerabilities remained unpatched after 28 days in 2025, according to ThreatDown.

Additional patches require more testing and validation, increasing operational overhead and the risks of frequent system changes, ThreatDown reports. IT teams must evaluate patches, test compatibility, and schedule updates without disrupting critical business operations. The patching challenge is especially significant for organizations already struggling with patch management. Ryan Powell, ThreatDown’s vice president of IT and security, said organizations can manage the growing workload with automated patching systems.

ThreatDown says AI could ultimately make software more secure despite accelerating vulnerability discovery. VMware says artificial intelligence models excel at finding vulnerabilities, building exploits, and linking them together, driving an explosion of CVEs and patches. AI can combine low- and moderate-severity flaws into something as damaging as one critical issue, making CVSS scores alone inadequate. AI can read advisories, compare patches, and quickly determine which flaws fit together into attack chains, according to VMware.

Bad actors use AI to do their work faster and with more accuracy, VMware says. Software vendors publishing details about security improvements may give bad actors hints about where to look. Release notes across the industry can be short on detail, VMware states. The explosion of CVEs and patches is stressful for organizations and their change control processes, VMware adds.

CISA keeps the Known Exploited Vulnerabilities catalog, which lists vulnerabilities that someone has confirmed attackers are using, according to VMware. VMware describes the Exploit Prediction Scoring System as an estimate of the chance that attackers will exploit a vulnerability within the coming 30 days. VMware advises checking whether attackers can reach a vulnerable component and where that component sits on the network. An internet-reachable interface presents far less work for an attacker than one on an isolated management network, VMware says.

Vulnerabilities in widely used components such as OpenSSL create supply-chain pressure because downstream vendors must release updates first, according to ThreatDown. ThreatDown points to OpenSSL flaw CVE-2022-0778, patched in March 2022, noting that some affected products waited months for updates. NVD first scored OpenSSH flaw CVE-2023-51385 at 9.8 Critical, later revised to 6.5; others scored 4.8 and 3.9. Building an attack chain used to take a skilled person days or weeks, VMware says.

Low and moderate vulnerabilities still need patching because a backlog is raw material for a chain, VMware says. Staying current beats picking and choosing; regular full updates remove all pieces at once. A chain fails when you break any one link; isolation, hardening, and multifactor authentication break links. Products past End of General Support are not evaluated, and downlevel versions should be assumed affected, VMware says.

VMware encourages applying all updates and notes Live Patch requires sequential patching from version A to B to C to D. The blog post is Day 5 of 22 in VMware’s Cybersecurity Awareness Month series. VMware says many organizations have trouble assessing and mitigating security risk. Organizations that pick updates based solely on criticality get caught off guard, VMware says.

Software vendors everywhere are using AI to examine their own code, VMware states. EFF recommends keeping browsers and all applications up to date with the latest patches. The group recommends installing a tracker blocking tool such as Privacy Badger, now available on Safari, and remaining vigilant for phishing attempts. EFF also recommends installing a password manager and using unique passwords for each website.

People who host a blog or website should ensure they or their hosting provider have patched the affected issue, EFF advises. EFF points readers to its Surveillance Self-Defense guides for security advice and seeks donations for open-source projects such as Privacy Badger, Rayhunter, and Certbot.

EFF states it is going to get worse before it gets better. EFF also states that a lot of computers are going to get hacked a lot more often and it isn’t going to get better any time soon. EFF opens its post by describing technically inclined friends freaking out about the Vulnerability Apocalypse this week, specifically about PHP. EFF directs readers to its other blog for detailed information on what happened and why supporting open-source matters.