AI-Driven Vulnerability Discovery Forces Shift in Security Validation

The number of published Common Vulnerabilities and Exposures (CVEs) reached 35,853 in the first half of 2026, representing a 49% increase compared to the previous year. This surge, driven in part by artificial intelligence, is creating a significant challenge for security defenders tasked with identifying which exposures require immediate action.

Despite the massive increase in discovered vulnerabilities, the actual rate of exploitation remains a relatively small fraction of the total. During the same six-month period, only 495 of the published CVEs were documented as being exploited in the wild, with 116 already under attack on the day they became public.

The Impact of AI-Driven Discovery

Artificial intelligence is significantly accelerating both the speed and scale of vulnerability discovery. Data from Anthropic indicates that Mythos-class models surfaced 26,153 vulnerability candidates within open-source software. However, a substantial gap exists in the remediation process, as only 421 of those findings have been patched upstream.

This disparity suggests that the volume of AI-generated findings is rapidly outstripping the capacity of traditional patching workflows, making it harder for organisations to manage their total exposure.

Limitations of CVSS Severity Scoring

The reliance on the Common Vulnerability Scoring System (CVSS) as the primary metric for remediation is being challenged. While CVSS provides a baseline for severity, it lacks the environmental context required to determine the actual impact on a specific organisation.

A vulnerability with a ‘Critical’ rating may not pose an immediate threat if the affected asset is unreachable, sits behind effective security controls, or is not business-critical. Consequently, security teams are being urged to move away from treating every high-severity score as an emergency and instead focus on evidence-based validation.

The Shift Toward Multi-Layered Validation

To manage the growing exposure problem, experts recommend a more nuanced approach that combines three key validation methods:

• Exploitability validation: Determining if an exposure is actually exploitable in a specific environment, including cases where a public proof-of-concept is not yet available.
• Security control validation: Testing whether existing prevention and detection tools effectively block or identify attack attempts.
• Agentic pentesting: Using automated approaches to safely run exploits and chain multiple vulnerabilities to demonstrate potential attack paths across a network.

Integrating these methods allows security teams to adopt a decision-driven response, focusing resources on the vulnerabilities that pose the greatest verified risk to their unique environments.