AI Accelerates Detection of Software Flaws; Microsoft and Google Set Records

Security updates arriving on your phones and laptops now feature more security fixes than before, and the primary reason behind this is Artificial Intelligence (AI). AI tools are succeeding in identifying vulnerabilities within software even faster than human researchers. According to an NDTV report, this technology has led to a significant surge in the process of discovering software flaws.

Due to this increasing rate of flaw detection this year, companies have released a record number of security fixes compared to previous years. For instance, in October alone, Microsoft fixed as many flaws as it had fixed in any previous full year. Similarly, Google's Chrome browser has released nearly 14 times more security fixes this year compared to the entire year of 2025.

Globally, more than 84,000 software flaws have been publicly listed in the CVE (Common Vulnerabilities and Exposures) system so far this year, which is nearly double the figure of approximately 45,000 recorded in 2025. Research group Epoch AI noted that in June alone, reports of high-severity and critical flaws were more than three times higher than previous monthly records. While precise data on AI's exact contribution to this increase is unavailable, security firm VulnCheck stated that 1,061 flaws discovered with the help of AI were recorded in the first six months of 2026, though these figures may vary across different organisations.

This surge began in April when Anthropic announced 'Claude Mythos Preview'. This is a model capable of independently finding and exploiting flaws. Access to this model was granted to only 50 partner organisations, and the company stated that they discovered more than 10,000 critical flaws in the first month alone. Additionally, Google, OpenAI, and Microsoft also possess their own proprietary tools.

Detecting software flaws early is beneficial as every fixed flaw creates a hurdle for hackers. However, any fix only secures devices that install the update. Devices that are not updated, such as old phones or old PCs, remain at risk. A matter of concern is that the same AI tools helping to find flaws could be used by attackers in the future to discover vulnerabilities.

Pressure is also mounting on systems that track flaws. In April, the US National Institute of Standards and Technology stopped the full analysis of old entries in its CVE database and moved approximately 29,000 entries to the "not scheduled" category.

Looking at company data, between January and October, Google released 3,686 security fixes in Chrome's computer updates, whereas this figure was only 270 in 2025. Microsoft fixed 4,265 flaws requiring users to install updates, significantly higher than last year's 1,209. Oracle, whose software runs in numerous banks, airlines, and hospitals, released 3,561 security fixes, compared to 1,379 in 2025.