AI Is Finding Software Flaws Faster Than The World Can Fix Them

The security updates landing on your phone and laptop now carry more security fixes than ever, and artificial intelligence is a big reason why. AI tools are finding weaknesses in software faster than human researchers ever could.

In October, Microsoft fixed more flaws in a single month than in any previous full year. Google's Chrome browser has released nearly 14 times as many security fixes this year as in all of 2025.

Finding flaws early is good news: each one fixed is one hackers can't use. But a fix protects only the devices that install it. Those that don't, from older phones to outdated PCs, are left exposed, and the same AI tools could one day help attackers find a way in.

A Flood Of Flaws

More than 84,000 software flaws have been publicly listed in the global CVE (Common Vulnerability and Exposure) system so far this year, up from about 45,000 in all of 2025. 

Research group Epoch AI found that in June alone, reports of high-severity and critical flaws were more than three times the previous monthly record. How much of this is down to AI? No one knows precisely. Security firm VulnCheck counted 1,061 flaws credited to AI-assisted discovery in the first half of 2026 but counts vary widely depending on who is counting.

The New Bug Hunters

The surge took off in April, when Anthropic announced Claude Mythos Preview, a model it says can find and exploit flaws on its own. It gave access only to about 50 partner organisations, and says they found more than 10,000 serious flaws in the first month. Google, OpenAI and Microsoft have their own tools.

The systems that track flaws are straining too. In April, the US National Institute of Standards and Technology stopped fully analysing older entries in its CVE database, moving about 29,000 into a "Not Scheduled" category.

A Pile Of Fixes

Every flaw found needs a fix, and every fix needs installing. Between January and October, Google released 3,686 security fixes in Chrome's computer updates, against 270 in all of 2025. Microsoft fixed 4,265 flaws that require users to install updates, up from 1,209 last year.

Oracle, whose software runs many banks, airlines and hospitals, released 3,561 security fixes, against 1,379 in 2025. Apple's latest Mac operating system macOS 27 Golden Gate, released in September, shipped with 204 fixes, its most ever for a single release.

Why It Matters

Once a fix is released, the flaw it closes becomes public, and attackers can study it. Devices that skip updates stay exposed.

So far, the flood of flaws has not become a wave of attacks. Flaws that the US cybersecurity agency CISA confirmed hackers had used rose from 245 in 2025 to 283 so far this year. That is about three for every 1,000 flaws reported.

But the same AI tools could also help attackers, and evidence of attacks often surfaces months later.

Who Is Exposed In India

In India, many devices may miss these fixes altogether. In September, about 41% of Windows desktop web traffic in India came from Windows 10, according to analytics firm StatCounter. Windows 10 now gets security fixes only to users who sign up for its extended update programme which costs nearly Rs 6000 for the first year. The price doubles every consecutive year.

On phones, about one in five Android devices browsing the web runs Android 12 or older. Google no longer sends these versions its critical system security fixes.

Pirated software adds to the risk. The latest industry estimate, from software trade group BSA in 2016, found that 58% of software installed on Indian PCs was unlicensed. In a 2018 Microsoft test, 17 of 22 Windows PCs bought from Indian shops came loaded with unlicensed software.

The best way to protect yourself from cyberattacks is simple: turn on automatic updates, and check whether your devices still receive them. Don't rely on unlicensed software.