AI-Found Vulnerabilities More Likely to Enable RCE, Google Says

Vulnerabilities found via AI are disproportionately likely to enable remote code execution (RCE), with 50% of AI-discovered vulnerabilities resulting in RCE, compared to 26% of other CVEs. Vulnerability disclosures doubled between January 2026 and July 2026, reaching 10,477 disclosures in July and 10,740 in August. Exploited vulnerabilities rose from an average of 10.5 per month in 2025 to 18 per month in 2026. The growth in exploitation was largely attributed to the rapid weaponization of n-days, potentially aided by AI tools analyzing patches and proof-of-concept code. Medium-risk flaws accounted for 58% of likely AI-discovered vulnerabilities between January and August 2026. This distribution is suggested to reflect how researchers deploy autonomous agents targeting critical infrastructure rather than broad scans. A specific example cited is CVE-2026-1731, an unauthenticated command injection flaw found autonomously by Hacktron AI, which was exploited within four days of disclosure and led to five further exploits within seven days. Risk concentration in exploitation occurred at the perimeter, where edge and security appliances accounted for 14% of exploited vulnerabilities in 2026, with over 65% of those edge flaws being rated high or critical risk.

The narrative reveals a critical shift where the capacity for automated discovery is directly translating into higher-impact exploitation, specifically concerning remote code execution. The disproportionate success rate suggests that the velocity introduced by AI in the vulnerability lifecycle—from discovery to weaponization—outpaces traditional defensive and patching cycles. The focus on autonomous agents targeting infrastructure implies that risk concentration is not random but strategically focused, as evidenced by the concentration of exploited flaws at perimeter edge devices. This structure moves the threat landscape away from broad scanning and toward specific, high-value targets managed via orchestration frameworks. The implication for agency is that the speed advantage gained through AI creation must be countered by commensurate increases in defensive automation; if agents can weaponize n-days rapidly, traditional reactive patching will become obsolete before mitigation can be applied. The question is whether defensive postures designed for human-paced discovery are sufficient to manage machine-paced exploitation. What systems of accountability must evolve when the mechanism of risk generation becomes increasingly opaque and autonomous?