AI-Driven Bug Hunting Triggers 'Vulnpocalypse' as Vendor Backlogs Explode
Automated vulnerability discovery is outpacing human triage, leaving critical software flaws sitting in backlogs for months.
Frontier AI models are automating software bug discovery at an unprecedented scale, triggering a 'vulnpocalypse' of reports that is overwhelming software vendors. While the cost and time required to find flaws have plummeted, the human-led processes for triage and patching have failed to keep pace, creating a systemic bottleneck in global cybersecurity.
The scale of the surge is stark. HackerOne reported that the number of critical vulnerabilities sitting in backlogs has increased 30 times over the past 12 months, with total reports doubling year over year due to AI automation. The technical capability to find these flaws has shifted from specialist human research to autonomous systems. Anthropic's Project Glasswing, utilizing the Claude Mythos Preview model, has demonstrated the ability to identify vulnerabilities at scale, including the discovery of a 27-year-old flaw in OpenBSD. Similarly, Palo Alto Networks' autonomous AI system, NOVA, identified 14,090 previously unknown software vulnerabilities during a single two-month evaluation.
The End of Hidden Flaws
Historically, vulnerability research was a scarce activity limited by human capacity, allowing vendors to operate on a 'find-and-fix' model. The emergence of Large Language Models (LLMs) and specialized cybersecurity AI has fundamentally altered these economics, shifting bug hunting from a severity-based game to one of sheer volume. This shift has exposed a critical failure in the 'responsible disclosure' pipeline, where the intake capacity of vendors is far lower than the discovery capacity of AI.
Aaron Portnoy, CPO at Mindgard, notes that software vendors previously shipped buggy software with little accountability, but AI's ability to work at scale means they can no longer hide these flaws. Katie Moussouris, CEO of Luta Security, suggests that the bug bounty ecosystem has long been struggling, and the current AI surge has simply revealed those existing systemic weaknesses.
The Exposure Window Risk
This imbalance creates a dangerous 'exposure window'—the time a vulnerability exists before a patch is deployed. When AI can identify thousands of bugs instantly but vendors take months to triage them, the window for malicious actors to exploit these flaws widens significantly. The primary risk is no longer just the existence of a bug, but the lag between its discovery and its remediation.
A Shift Toward Secure-by-Design
To mitigate this risk, the industry is facing a reckoning that necessitates a move away from reactive patching. Experts argue that the only sustainable solution is a transition to 'secure-by-design' software factories. By integrating security into the initial development phase to prevent bugs from being introduced, vendors can reduce their reliance on a disclosure pipeline that is currently incapable of handling AI-generated volume.
As autonomous discovery tools become more accessible, the industry must now determine if triage and patching can also be automated, or if the current disclosure model will collapse under the weight of its own efficiency.