AI FINDS FLAWS, BUT EXPLOITS REMAIN RARE

VulnCheck analyzed 1,061 vulnerabilities identified by AI systems in the first half of 2026. Only 14 resulted in confirmed exploits—a rate matching traditional vulnerability discovery methods. However, attackers are moving faster when they do strike. The median time between vulnerability discovery and active exploitation dropped from 120 days to 80 days. The findings suggest AI security tools are effective at identifying flaws, but the gap between discovery and real-world attacks remains large. Most vulnerabilities never face exploitation attempts, whether found by AI or conventional means. The accelerating exploit timeline raises separate concerns. Security teams have less time to patch critical flaws before attackers weaponize them, despite the overall rarity of AI-discovered vulnerabilities being targeted.