AI is finding cybersecurity flaws at a record pace, and Microsoft's July patch update fixed more bugs than ever before

[LurkingLegend]

The number of software security flaws discovered in popular technology products in 2026 is on pace to roughly double the tally that surfaced in 2025, an explosion Bloomberg attributes directly to increasingly capable AI systems now hunting for vulnerabilities at scale. Microsoft's July Patch Tuesday fixed a record 622 flaws, more than tripling June's own record setting tally, with the company crediting AI powered discovery tools including its own MDASH agentic scanning system, which alone found 16 of the flaws patched in May. Anthropic's Mythos model has separately been credited with a surge of fixes across the industry, and Mozilla reported fixing 423 Firefox bugs in a single month this year, nearly 20 times its prior yearly monthly average, crediting Mythos with finding 271 of those flaws in one Firefox release alone

More than two dozen companies including JPMorgan Chase, Cisco, Cloudflare and cybersecurity startup Chainguard have formed a coalition called Athena specifically to coordinate remediation of open source flaws AI tools are surfacing faster than teams can triage them. The scale is creating a genuinely new problem though, once a patch ships, attackers can compare it against the old code, spot exactly what it fixes, and build a working exploit within hours rather than the days or weeks defenders used to have. One security researcher described watching an attacker build a working exploit for a critical flaw in just nine hours after disclosure, faster than most organizations' patch approval processes even convene

This is also scrambling how defenders prioritize what to fix first. Of July's 622 Microsoft fixes, one of the two flaws already being actively exploited carried only a moderate severity score rather than critical, meaning any organization simply rushing to patch critical rated bugs first would have missed the exact flaw attackers were already using. Trend Micro's Dustin Childs summed up the mood bluntly, calling it the bug apocalypse, and Chinese cybersecurity firm 360 Digital Security Group has separately built its own AI powered vulnerability discovery agent, uncovering close to 1,000 previously unknown flaws including in Microsoft Office, positioning itself as a direct competitor to Western AI security tools in this same race

Ai Hunts For Cyber Flaws Finding Record Numbers In Tech Sectorwww.bloomberg.com