What Google's AI vulnerability discovery report means for builders

What Google's AI vulnerability discovery report means for builders

Google Threat Intelligence Group (GTIG) just put hard numbers behind something a lot of security teams have been feeling all year: AI is not only speeding up how bugs get found. It is changing which bugs get found, and how fast attackers can turn a fresh disclosure into a working exploit.

The research covers vulnerability disclosure and exploitation from January 2025 through August 2026. The headline stats are uncomfortable, but they are also useful if you ship software, run agents, or keep edge appliances online.

What GTIG actually measured

Monthly CVE disclosures roughly doubled in 2026, from 5,045 in January to 10,740 in August. That does not mean every team suddenly got twice as exposed. GTIG notes that automated CVE assignment in open source ecosystems can inflate the raw count. Linux kernel description matches alone accounted for roughly 5,000 CVEs in the first eight months of 2026, with no observed in-the-wild zero-day exploitation of that pile.

Exploitation is still rare in percentage terms. Only 0.23% of vulnerabilities disclosed this year, about one in 431, were observed exploited in the wild. Absolute volume is another story. GTIG recorded 141 distinct exploited vulnerabilities from January through August 2026, more than the 127 seen in all of 2025. That works out to about 18 exploited vulns per month, up from 10.5 last year.

Zero-day exploitation rose only modestly, from an average of eight per month in 2025 to eleven per month in 2026, with a spike to 22 in August. GTIG's read is that much of the growth is n-day: attackers weaponizing recently patched or recently disclosed bugs faster than before.

One plausible reason, according to the report, is that threat actors can use LLMs and AI tools to chew through patch diffs, disclosure notes, and proof-of-concept code, then turn an n-day into something usable without burning a true zero-day.

AI-found bugs look different

The most interesting part of the report is not volume. It is the risk profile of vulnerabilities GTIG flagged as likely discovered by AI.

Half of those AI-discovered vulnerabilities lead to remote code execution. For non-AI discoveries, the RCE share is 26%. AI-found issues were also less likely to land in the low-risk bucket under GTIG's own ratings: 39% low and 58% medium for AI-linked findings, versus 69% low and 28% medium for the rest.

GTIG's explanation is practical rather than mystical. Research programs often point autonomous agents at infrastructure, privilege boundaries, and high-value attack surfaces. Models are also better than classic static analyzers at spotting certain memory corruption and logic bugs. Public CVE data almost certainly undercounts AI discoveries too, because there is no standard AI-attribution tag, and cloud or SaaS vendors often fix AI-found issues quietly without requesting a CVE.

In short: defensive AI is hunting in the same neighborhoods attackers care about.

Attackers did not wait on an AI-found BeyondTrust bug

GTIG points to CVE-2026-1731 as an early warning shot. It is an unauthenticated OS command injection issue in BeyondTrust Privileged Remote Access and Remote Support. The Hacktron AI research agent discovered it autonomously.

Threat actors used it in targeted initial-access campaigns. GTIG saw one threat cluster exploit it within four days of public disclosure. Five more clusters followed within seven days. After getting in, attackers escalated privileges, pulled data, and dropped payloads that included SNOWLIGHT, SPARKRAT, and cryptominers.

That timeline is the part builders should keep on a sticky note. Discovery by a defensive AI agent does not buy you a leisurely patch window. Once the bug is public, the same class of tooling that helped find it can help the other side operationalize it.

AI software itself is filling up with CVEs

GTIG also tracked vulnerabilities in AI-related software: 2,076 between January 2025 and August 2026, with more than 1,500 disclosed in 2026 alone.

About half of this year's AI-related disclosures hit agent orchestration frameworks such as Flowise and Langflow. The common pattern is ugly and familiar if you have ever left a code-execution node reachable: prompt injection or crafted workflow JSON that turns a helper graph into remote code execution.

Inference and serving stacks are next. Tools like vLLM, Ollama, and LiteLLM accounted for 212 vulnerabilities disclosed in 2026. Nearly a quarter of those came from unauthenticated API endpoints or server-side request forgery. In practice that can mean firewall bypasses, GPU burn, stolen model checkpoints, or a compromised gateway that leaks third-party API keys and private prompt streams that may contain PII or source code.

Confirmed in-the-wild exploitation of AI infrastructure is still limited. GTIG cites a LiteLLM command injection flaw (CVE-2026-42271) that can lead to host takeover and API credential theft, plus Langflow issues (CVE-2026-5027 and CVE-2025-3248) that allow writing files or running code on the host. GTIG says it has not yet observed zero-day exploitation of AI infrastructure, but the disclosure trend is clearly headed up.

Practical takeaways for builders

If you are building or operating software in 2026, the report points to a few concrete habits.

Treat high-impact disclosures as urgent, not informational. An AI-found RCE in a remote-access product or a gateway you expose to the internet is not a "patch next sprint" item. Assume weaponization within days, not weeks.

Prioritize with threat intel, not CVE volume. Mass patching every medium CVSS score will drown a small team. GTIG's own conclusion is to move toward threat-intelligence-driven triage: focus on edge-facing systems, privilege boundaries, and issues already tied to exploitation or easy RCE.

Lock down agent orchestration and inference endpoints. If Flowise, Langflow, LiteLLM, Ollama, or a custom MCP-style tool server is reachable without strong auth, treat that as an incident waiting to happen. Require authentication, restrict network exposure, and do not leave code-execution or SSRF-friendly tools on the public internet.

Watch your AI gateways for credential and prompt leakage. A compromised gateway is not just a model outage. It can expose API keys and the prompt traffic that contains customer data or proprietary code.

Assume attackers use AI on patches too. The old comfort of "disclosure plus a few quiet days" is thinner when LLMs can summarize diffs and PoCs overnight. Pair public monitoring with automated regression tests and, where you can, agentic remediation that proposes or applies known-safe fixes quickly.

Keep privileged remote-access products patched and logged. BeyondTrust was the example in this report, but the pattern applies to any jump host, remote support appliance, or PAM-adjacent tool. Those are initial-access magnets.

A short FAQ

Does this mean AI security tools are making the internet less safe? Not exactly. Defensive AI is finding serious bugs that attackers want. The risk is the lag between public disclosure and remediation. Faster discovery without faster patching widens the window.

Should every team buy an autonomous vuln-hunting agent tomorrow? Not necessarily. Many teams get more value first from inventorying internet-facing services, shutting down unauthenticated AI endpoints, and tightening patch SLAs for RCE and remote-access products.

Are AI frameworks uniquely dangerous? They are uniquely new and often deployed with powerful defaults: code runners, broad tool access, and APIs that were never meant to be public. That combination shows up clearly in GTIG's 2026 disclosure numbers.

Bottom line

GTIG's report is less a panic button and more a calendar reminder. Vulnerability discovery is accelerating, AI-found bugs skew toward remote code execution, and at least one AI-discovered flaw was under active exploitation within four days. If your patch process, agent deployments, or inference stack still assume a slow human-only attacker, it is time to update that mental model.

For teams that also care about calmer day-to-day operations beyond security fire drills, nearfree.shop publishes practical guides on replacing spreadsheet-heavy workflows with focused business software you can own and deploy yourself.