Welcome to the inaugural version of Kernel Panic! A weekly publication by Lily Hay Newman and Matt Burgess from inside the brand new world of privateness and digital safety. To obtain this text in your inbox every week, enroll right here.
AI doomers have lately traded one worst-case state of affairs for one more, placing apart a possible software program vulnerability apocalypse to deal with the opportunity of rogue AI inflicting mass human dying within the subsequent decade. As AI leaders contemplate a cooperative slowdown on frontier mannequin growth, although, one facet of the cybersecurity sea change has already arrived because of current, broadly accessible capabilities in mainstream AI merchandise, together with open weight fashions.
A tidal wave of vulnerabilities uncovered utilizing AI has solely accelerated in latest months—piling extra stress on under-resourced, and really human, IT and safety groups and straining volunteers who preserve essential open supply software program. Researchers discovered and disclosed an unlimited array of vulnerabilities earlier than the rise of AI-enhanced bug searching as properly, however the latest surge is obvious.
Microsoft stated final week that it has issued patches for 974 CVEs to this point this month, setting a brand new file. (CVEs, or frequent vulnerabilities and exposures, is cybersecurity jargon for confirmed software program flaws.) In July, Oracle shipped 1,448 patches in comparison with 309 in July 2025. Google Chrome’s two main model releases in June included 1,072 patches, greater than the entire vulnerability fixes shipped within the prior 23 large releases mixed. And Mozilla stated in April that it discovered 271 vulnerabilities in Firefox throughout one bug searching dash utilizing Anthropic’s Mythos mannequin.
Throughout the board, there have been a shocking 66,401 CVEs recorded as of Wednesday this week, in accordance with Jerry Gamblin, the top of analysis at Empirical Safety and founding father of RogoLabs, which runs the CVE evaluation challenge cve.icu. By September 16 final yr, cve.icu had logged a complete of 33,512 CVEs—nearly half the present complete. For all of 2022, the yr OpenAI launched its first model of ChatGPT, cve.icu recorded 25,000 CVEs.
Amongst each safety and AI researchers, consultants have been divided about whether or not this spike and different impacts of AI on cybersecurity shall be catastrophic or as a substitute enlarge current dynamics and challenges. Some have identified that sluggish patch adoption and lagging funding in cybersecurity broadly already gave attackers many benefits that led to hacking disasters earlier than the rise of AI. However as vulnerability discovery numbers have continued to rise, and the dialogue has turn into much less theoretical, the 2 sides have appeared to maneuver a bit nearer.
“I don’t suppose it’s overblown,” Gamblin says of the obvious explosion in vulnerability findings throughout the trade. “What I might push again on is the concept an even bigger quantity is itself the hurt. Extra CVEs shouldn’t be extra vulnerability. It is extra identified vulnerability, which is usually the system working.”
The concern, although, is that huge vulnerability discovery will imply builders getting outpaced on patching, software program customers who can’t patch quick sufficient, and an array of escalating cyberattacks fueled by extra attackers discovering novel vulnerabilities on their very own utilizing AI. As Britain’s Nationwide Cyber Safety Middle puts it, “Simply discovering vulnerabilities does nothing to enhance your safety.”