{"id":5357,"date":"2026-09-20T01:30:36","date_gmt":"2026-09-20T04:30:36","guid":{"rendered":"https:\/\/tucumandevelopers.com\/index.php\/2026\/09\/20\/ai-is-finding-vulnerabilities-faster-than-humans-can-patch-them-and-thats-becoming-a-security-crisis\/"},"modified":"2026-09-20T01:30:36","modified_gmt":"2026-09-20T04:30:36","slug":"ai-is-finding-vulnerabilities-faster-than-humans-can-patch-them-and-thats-becoming-a-security-crisis","status":"publish","type":"post","link":"https:\/\/tucumandevelopers.com\/index.php\/2026\/09\/20\/ai-is-finding-vulnerabilities-faster-than-humans-can-patch-them-and-thats-becoming-a-security-crisis\/","title":{"rendered":"AI Is Finding Vulnerabilities Faster Than Humans Can Patch Them \u2014 And That\u2019s Becoming a Security Crisis"},"content":{"rendered":"<div>\n<div><\/div>\n<p>to: <\/p>\n<div>\n<pre><code>Machine-speed discovery \u2193 Human-speed remediation <\/code><\/pre>\n<div>\n<\/p><\/div>\n<\/p><\/div>\n<p>That imbalance is the real problem.<\/p>\n<hr>\n<h2> <a name=\"attackers-get-the-same-ai-advantage\" href=\"#attackers-get-the-same-ai-advantage\"> <\/a> Attackers Get the Same AI Advantage <\/h2>\n<p>There is another uncomfortable part.<\/p>\n<p>AI vulnerability research isn&#8217;t only available to defenders.<\/p>\n<p>Attackers can use similar models to:<\/p>\n<ul>\n<li>analyze public patches<\/li>\n<li>search for vulnerable code<\/li>\n<li>identify attack paths<\/li>\n<li>automate reconnaissance<\/li>\n<li>combine multiple weaknesses<\/li>\n<li>scale exploitation<\/li>\n<\/ul>\n<p>Google Cloud has warned about exactly this transition: defenders can use AI to harden software faster, but attackers can also use increasingly capable models to discover and exploit vulnerabilities.<\/p>\n<p>Microsoft makes a similar point.<\/p>\n<p>Its 2026 Secure Future Initiative report says frontier models are helping attackers discover vulnerabilities, chain attack paths, and scale exploitation faster than traditional manual methods.<\/p>\n<p>This changes the race.<\/p>\n<p>The old question was:<\/p>\n<blockquote>\n<p><strong>Can an attacker find the vulnerability?<\/strong><\/p>\n<\/blockquote>\n<p>The new question may become:<\/p>\n<blockquote>\n<p><strong>Who finds it first \u2014 and who acts faster?<\/strong><\/p>\n<\/blockquote>\n<hr>\n<h2> <a name=\"sometimes-exploitation-starts-before-the-patch-exists\" href=\"#sometimes-exploitation-starts-before-the-patch-exists\"> <\/a> Sometimes Exploitation Starts Before the Patch Exists <\/h2>\n<p>This is where things become especially difficult.<\/p>\n<p>Google&#8217;s Mandiant team reported that its 2026 data showed a mean <strong>time-to-exploit of -7 days<\/strong>.<\/p>\n<p>In simple terms, vulnerabilities are sometimes being exploited <strong>before a patch is available<\/strong>.<\/p>\n<p>Think about what that means for developers.<\/p>\n<p>You might not be racing against someone manually reading your code anymore.<\/p>\n<p>You could be racing against automated systems continuously searching for weaknesses.<\/p>\n<p>And when a vulnerability becomes public, the time between:<\/p>\n<p><strong>Disclosure \u2192 Exploitation<\/strong><\/p>\n<p>may continue getting shorter.<\/p>\n<hr>\n<h2> <a name=\"the-new-bottleneck-is-patching\" href=\"#the-new-bottleneck-is-patching\"> <\/a> The New Bottleneck Is Patching <\/h2>\n<p>Security teams already have vulnerability backlogs.<\/p>\n<p>Imagine a company has: <\/p>\n<div>\n<pre><code>50 known vulnerabilities <\/code><\/pre>\n<div>\n<\/p><\/div>\n<\/p><\/div>\n<p>and enough engineering capacity to properly fix: <\/p>\n<div>\n<pre><code>10 per month <\/code><\/pre>\n<div>\n<\/p><\/div>\n<\/p><\/div>\n<p>Now introduce AI-assisted vulnerability discovery.<\/p>\n<p>Suddenly the backlog becomes: <\/p>\n<div>\n<pre><code>50 \u2193 150 \u2193 500 \u2193 1,000 <\/code><\/pre>\n<div>\n<\/p><\/div>\n<\/p><\/div>\n<p>Finding more bugs is useful.<\/p>\n<p>But only if we can decide which ones matter and fix them fast enough.<\/p>\n<p>Otherwise we create something like:<\/p>\n<blockquote>\n<p><strong>Security debt at machine speed.<\/strong><\/p>\n<\/blockquote>\n<hr>\n<h2> <a name=\"patch-everything-isnt-a-real-strategy\" href=\"#patch-everything-isnt-a-real-strategy\"> <\/a> \u201cPatch Everything\u201d Isn&#8217;t a Real Strategy <\/h2>\n<p>When vulnerability numbers explode, developers cannot treat every finding equally.<\/p>\n<p>A CVSS score alone doesn&#8217;t tell the whole story.<\/p>\n<p>Teams need to ask:<\/p>\n<h3> <a name=\"is-it-internetfacing\" href=\"#is-it-internetfacing\"> <\/a> Is It Internet-Facing? <\/h3>\n<p>A vulnerability in a public API deserves different urgency from one in an isolated internal test system.<\/p>\n<h3> <a name=\"is-it-actually-exploitable\" href=\"#is-it-actually-exploitable\"> <\/a> Is It Actually Exploitable? <\/h3>\n<p>A theoretical vulnerability and an actively exploited vulnerability are not the same thing.<\/p>\n<h3> <a name=\"what-permissions-are-required\" href=\"#what-permissions-are-required\"> <\/a> What Permissions Are Required? <\/h3>\n<p>Can an anonymous user exploit it?<\/p>\n<p>Or does an attacker already need administrator access?<\/p>\n<h3> <a name=\"what-data-is-at-risk\" href=\"#what-data-is-at-risk\"> <\/a> What Data Is at Risk? <\/h3>\n<p>Could the vulnerability expose:<\/p>\n<ul>\n<li>passwords<\/li>\n<li>payment information<\/li>\n<li>customer data<\/li>\n<li>credentials<\/li>\n<li>infrastructure secrets?<\/li>\n<\/ul>\n<h3> <a name=\"is-there-evidence-of-active-exploitation\" href=\"#is-there-evidence-of-active-exploitation\"> <\/a> Is There Evidence of Active Exploitation? <\/h3>\n<p>If attackers are already using the vulnerability, priority changes immediately.<\/p>\n<p>The goal isn&#8217;t:<\/p>\n<blockquote>\n<p><strong>Patch the highest number of vulnerabilities.<\/strong><\/p>\n<\/blockquote>\n<p>The goal is:<\/p>\n<blockquote>\n<p><strong>Reduce the greatest amount of real risk as quickly as possible.<\/strong><\/p>\n<\/blockquote>\n<hr>\n<h2> <a name=\"ai-should-help-fix-vulnerabilities-too\" href=\"#ai-should-help-fix-vulnerabilities-too\"> <\/a> AI Should Help Fix Vulnerabilities Too <\/h2>\n<p>This is where I think things become interesting.<\/p>\n<p>If AI creates machine-speed vulnerability discovery, we also need <strong>machine-assisted remediation<\/strong>.<\/p>\n<p>And that is already starting.<\/p>\n<p>Google recently released <strong>Mantis<\/strong>, an open-source system designed to help automate:<\/p>\n<p><strong>Discovery \u2192 Triage \u2192 Reproduction \u2192 Patching<\/strong><\/p>\n<p>Google says the system combines agentic techniques with sandboxed reproduction so findings can be verified instead of relying purely on model guesses.<\/p>\n<p>That is important because security AI has another problem:<\/p>\n<p><strong>False positives.<\/strong><\/p>\n<p>An AI model saying:<\/p>\n<blockquote>\n<p>\u201cI found a critical vulnerability.\u201d<\/p>\n<\/blockquote>\n<p>doesn&#8217;t necessarily mean the vulnerability actually exists.<\/p>\n<p>Google notes that sloppy AI scanning can produce extremely weak true-positive rates.<\/p>\n<p>So the ideal workflow isn&#8217;t: <\/p>\n<div>\n<pre><code>AI finds bug \u2193 Developer blindly patches <\/code><\/pre>\n<div>\n<\/p><\/div>\n<\/p><\/div>\n<p>It should be: <\/p>\n<div>\n<pre><code>AI discovers candidate \u2193 AI reproduces vulnerability \u2193 Security tooling validates \u2193 AI proposes fix \u2193 Tests verify fix \u2193 Human reviews \u2193 Deploy <\/code><\/pre>\n<div>\n<\/p><\/div>\n<\/p><\/div>\n<p>That is much more useful.<\/p>\n<hr>\n<h2> <a name=\"developers-will-need-better-security-prioritization\" href=\"#developers-will-need-better-security-prioritization\"> <\/a> Developers Will Need Better Security Prioritization <\/h2>\n<p>For software engineers, I think this means security work is going to become less about simply asking:<\/p>\n<blockquote>\n<p>\u201cDo we have vulnerabilities?\u201d<\/p>\n<\/blockquote>\n<p>Almost every meaningful codebase will.<\/p>\n<p>The better questions will be:<\/p>\n<p><strong>Which vulnerability can actually hurt us?<\/strong><\/p>\n<p><strong>Which one is reachable?<\/strong><\/p>\n<p><strong>Which one is being exploited?<\/strong><\/p>\n<p><strong>Which system contains sensitive data?<\/strong><\/p>\n<p><strong>Which fix carries the least production risk?<\/strong><\/p>\n<p><strong>Which patch should go out first?<\/strong><\/p>\n<p>This is prioritization.<\/p>\n<p>And AI can help here too.<\/p>\n<hr>\n<h2> <a name=\"more-vulnerabilities-doesnt-necessarily-mean-software-is-getting-worse\" href=\"#more-vulnerabilities-doesnt-necessarily-mean-software-is-getting-worse\"> <\/a> More Vulnerabilities Doesn&#8217;t Necessarily Mean Software Is Getting Worse <\/h2>\n<p>This is an important distinction.<\/p>\n<p>If the number of discovered vulnerabilities suddenly doubles, that does not automatically mean developers became twice as bad at writing secure software.<\/p>\n<p>It can also mean:<\/p>\n<blockquote>\n<p><strong>Our ability to find existing weaknesses became dramatically better.<\/strong><\/p>\n<\/blockquote>\n<p>Think about medical imaging.<\/p>\n<p>If a better scanner detects more diseases, that doesn&#8217;t necessarily mean the population suddenly became much sicker.<\/p>\n<p>We simply became better at finding problems that were already there.<\/p>\n<p>AI may be doing something similar to software security.<\/p>\n<p>That is good.<\/p>\n<p>But discovering hidden problems creates a responsibility to deal with them.<\/p>\n<hr>\n<h2> <a name=\"what-development-teams-should-do-now\" href=\"#what-development-teams-should-do-now\"> <\/a> What Development Teams Should Do Now <\/h2>\n<p>I don&#8217;t think the answer is panic.<\/p>\n<p>But I do think security processes designed for a slower world need to evolve.<\/p>\n<h3> <a name=\"1-automate-dependency-and-vulnerability-scanning\" href=\"#1-automate-dependency-and-vulnerability-scanning\"> <\/a> 1. Automate Dependency and Vulnerability Scanning <\/h3>\n<p>Security checks should be part of CI\/CD, not something you remember before a release.<\/p>\n<h3> <a name=\"2-prioritize-by-real-risk\" href=\"#2-prioritize-by-real-risk\"> <\/a> 2. Prioritize by Real Risk <\/h3>\n<p>Combine severity with:<\/p>\n<ul>\n<li>exploitability<\/li>\n<li>exposure<\/li>\n<li>sensitive data<\/li>\n<li>active attacks<\/li>\n<li>business impact<\/li>\n<\/ul>\n<h3> <a name=\"3-patch-faster\" href=\"#3-patch-faster\"> <\/a> 3. Patch Faster <\/h3>\n<p>Oracle itself is now encouraging customers to move toward a <strong>monthly security patching cycle<\/strong>.<\/p>\n<p>Organizations with patch processes designed around slow quarterly workflows may struggle as vulnerability discovery accelerates.<\/p>\n<h3> <a name=\"4-use-ai-for-remediation-not-just-discovery\" href=\"#4-use-ai-for-remediation-not-just-discovery\"> <\/a> 4. Use AI for Remediation, Not Just Discovery <\/h3>\n<p>If AI finds 500 problems but humans have to manually investigate every one, the system doesn&#8217;t scale.<\/p>\n<p>AI-assisted reproduction, triage, testing, and patch generation will become increasingly important.<\/p>\n<h3> <a name=\"5-keep-humans-in-the-final-review\" href=\"#5-keep-humans-in-the-final-review\"> <\/a> 5. Keep Humans in the Final Review <\/h3>\n<p>Security patches can break production too.<\/p>\n<p>AI can help generate fixes.<\/p>\n<p>It shouldn&#8217;t mean:<\/p>\n<blockquote>\n<p><strong>AI found it \u2192 AI patched it \u2192 automatically deploy to production.<\/strong><\/p>\n<\/blockquote>\n<p>Critical changes still deserve engineering review.<\/p>\n<hr>\n<h2> <a name=\"the-security-race-is-changing\" href=\"#the-security-race-is-changing\"> <\/a> The Security Race Is Changing <\/h2>\n<p>The old security loop looked like this: <\/p>\n<div>\n<pre><code>Researcher finds bug \u2193 Vendor investigates \u2193 Patch released \u2193 Attackers reverse-engineer patch \u2193 Exploitation begins <\/code><\/pre>\n<div>\n<\/p><\/div>\n<\/p><\/div>\n<p>AI can compress several of those steps.<\/p>\n<p>The future could look more like: <\/p>\n<div>\n<pre><code>AI finds vulnerability \u2193 AI validates vulnerability \u2193 AI develops exploit \u2193 AI proposes patch \u2193 Humans race to deploy <\/code><\/pre>\n<div>\n<\/p><\/div>\n<\/p><\/div>\n<p>Both sides get faster.<\/p>\n<p>Attackers.<\/p>\n<p>Defenders.<\/p>\n<p>That means the winner may not simply be whoever has the smartest AI.<\/p>\n<p>It may be whoever has the <strong>fastest trustworthy security process<\/strong>.<\/p>\n<hr>\n<h2> <a name=\"final-thought\" href=\"#final-thought\"> <\/a> Final Thought <\/h2>\n<p>For years, we wanted machines that could automatically find security vulnerabilities.<\/p>\n<p>Now we&#8217;re getting them.<\/p>\n<p>That is a major achievement.<\/p>\n<p>But it creates a strange new challenge:<\/p>\n<blockquote>\n<p><strong>What if finding vulnerabilities becomes easier than fixing them?<\/strong><\/p>\n<\/blockquote>\n<p>The future of application security will not only be about discovering more bugs.<\/p>\n<p>It will be about:<\/p>\n<p><strong>Prioritizing faster<\/strong><\/p>\n<p><strong>Validating faster<\/strong><\/p>\n<p><strong>Fixing faster<\/strong><\/p>\n<p><strong>Testing faster<\/strong><\/p>\n<p><strong>Deploying faster<\/strong><\/p>\n<p>without sacrificing reliability.<\/p>\n<p>Because if AI can find vulnerabilities at machine speed while organizations still patch them at human speed, the vulnerability itself may no longer be the biggest bottleneck.<\/p>\n<p><strong>Our ability to respond will be.<\/strong><\/p>\n<hr>\n<h2> <a name=\"sources\" href=\"#sources\"> <\/a> Sources <\/h2>\n<p><strong>Oracle \u2014 July 2026 Critical Patch Update<\/strong><br \/> Oracle&#8217;s largest security release to date, covering 1,434 distinct CVEs and highlighting AI-powered vulnerability identification.<\/p>\n<p><strong>Google Cloud \/ Mandiant \u2014 AI-Assisted Vulnerability Management<\/strong><br \/> Research on AI vulnerability discovery, exploitation speed, and defensive workflows.<\/p>\n<p><strong>Google \u2014 Mantis<\/strong><br \/> Open-source AI-assisted vulnerability discovery, reproduction, triage, and patching.<\/p>\n<p><strong>Microsoft \u2014 Secure Future Initiative 2026<\/strong><br \/> Discussion of AI accelerating vulnerability discovery and exploitation for both attackers and defenders.<\/p>\n<p><strong>Wired \u2014 September 2026<\/strong><br \/> Reporting on the rapid growth in vulnerability discovery and CVE volume.<\/p>\n<\/p><\/div>\n<\/div>\n<\/div>\n<\/div>\n<p>Fuente: <a href=\"https:\/\/dev.to\/robertadam987_\/ai-is-finding-vulnerabilities-faster-than-humans-can-patch-them-and-thats-becoming-a-security-1j04\">Art\u00edculo original<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>to: Machine-speed discovery \u2193 Human-speed remediation That imbalance is the real problem. Attackers Get the Same AI Advantage There is another uncomfortable part. AI vulnerability research isn&#8217;t only available to defenders. Attackers can use similar models to: analyze public patches search for vulnerable code identify attack paths automate reconnaissance combine multiple weaknesses scale exploitation Google [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":5356,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"webixso_pending_account_ids":""},"categories":[41],"tags":[],"class_list":["post-5357","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devto"],"jetpack_publicize_connections":[],"_links":{"self":[{"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/posts\/5357","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/comments?post=5357"}],"version-history":[{"count":0,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/posts\/5357\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/media\/5356"}],"wp:attachment":[{"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/media?parent=5357"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/categories?post=5357"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/tags?post=5357"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}