GTIG Data Reveals: Vulnerability Disclosures Double in the AI Era

Vulnerability Disclosures Double, But Only 0.23% Are Real Threats

Google Threat Intelligence Group (GTIG) has released its first complete dataset on how AI is reshaping the vulnerability landscape. The most eye-catching number is the doubling: 5,045 vulnerabilities disclosed in January 2026 grew to 10,740 by August.

But the real story isn't that headline number — it's the denominator. GTIG recorded 141 vulnerabilities disclosed and actually exploited between January and August 2026 — already exceeding the 127 for all of 2025 — but that's just 0.23% of all disclosed vulnerabilities, roughly 1 in every 431. Thousands of new CVEs emerge each week, yet attackers only touch a few dozen.

This gap is precisely the core argument for intelligence-driven triage. GTIG explicitly notes that raw disclosure volume is severely inflated: "Without threat intelligence context, raw disclosure volume in 2026 can be misleading. Automated CNA numbering policies in the open source ecosystem inflate baseline figures." A telling example: vulnerabilities whose descriptions contained "Linux Kernel" generated roughly 5,000 CVEs between January and August 2026, yet the number of zero-days observed being exploited in the wild was zero. If you patch by volume, you're chasing a curve inflated by vendors' own numbering processes.

A risk-rating perspective confirms this. High-risk disclosures surged from 131 in January 2026 to 350 in August, a 167% increase, yet still account for only 3% of all disclosures. Two forces drove this spike: a large-scale research disclosure targeting TOTOLINK consumer router firmware (75 high-risk vulnerabilities in April-May), and Oracle's quarterly CPU plus Linux kernel network driver security advisories (128 high-risk in August alone, nearly 37% of that month's high-risk total). The disclosure world is vast, and most of it is noise; that narrow high-risk slice is what's actionable.

CVE and CNA mechanisms: CVE (Common Vulnerabilities and Exposures) is the global public numbering system for vulnerabilities, assigning each vulnerability a unique identifier for cross-vendor, cross-tool tracking. A CNA (CVE Numbering Authority) is an organization authorized to assign CVE numbers itself, including major vendors, open source foundations, and third-party research organizations. The problem is that numbering standards aren't unified across CNAs: some organizations assign a CVE whenever a code change touches security-relevant logic, while others pre-assign in bulk before a merge is submitted. This is exactly what "automated CNA numbering policies inflate baseline figures" means — the number reflects process aggressiveness, not an expansion of the real attack surface.

The difference between zero-day and n-day: A zero-day refers to a vulnerability for which the vendor has not yet released a patch and the public is unaware, giving attackers an information asymmetry advantage. An n-day refers to a vulnerability with a public patch or disclosure, but where large numbers of systems remain unpatched. Traditionally zero-days are considered the highest threat, but the data here shows n-day weaponization speed is accelerating dramatically, with AI tools sharply shortening the cycle from patch diff analysis to working exploit code. Understanding this distinction is key to understanding why "exploited vulnerabilities are concentrating upward."

Exploited Vulnerabilities Are Concentrating Upward

In 2025, an average of 10.5 vulnerabilities were exploited per month; from January to August 2026, that rose to 18 per month. GTIG's composition analysis reveals where the growth truly lies: "The primary source of exploit growth from January to August 2026 is concentrated in rapid n-day weaponization." Zero-day exploitation rose only modestly — from 8 to 11 per month, spiking to 22 in August — while high-risk exploitation doubled from 28 in 2025 to 75 in the first eight months of 2026.

Zero-days still account for 62% of exploited vulnerabilities, which seems counterintuitive: n-day exploitation is growing faster, yet zero-days remain the majority actually observed. Since May 2026, the two curves have moved in tandem — exploit growth (indexed +127%) and disclosure growth (indexed +128%) advancing together, "scaling in step with the overall vulnerability landscape rather than outpacing it."

This ratio overturns the usual threat model intuition. The growth comes from rapid weaponization of already-disclosed vulnerabilities, which GTIG speculates is precisely because AI makes it cheaper: "Threat actors find it easier or more efficient to use LLMs and AI tools to automatically analyze product version differences, patches, vulnerability disclosure announcements, and PoC code to rapidly weaponize n-days than to discover new zero-days." N-day exploitation is now a diff-analysis and packaging problem — exactly the labor category AI can dramatically compress.

AI-Discovered Vulnerabilities Look Different, and the Market Is Moving With Them

The dataset's third finding points most directly to the field's future: AI-assisted discovery finds more vulnerabilities, and their "profile" differs. Among vulnerabilities GTIG could identify as likely AI-discovered, low-risk findings fell to 39% (versus 69% for traditional discovery), medium-risk rose to 58% (versus 28% traditionally), and the most striking number — exactly 50% of AI-discovered vulnerabilities lead to remote code execution, versus 26% across the entire ecosystem.

GTIG's explanation is structural: AI agents are designed to navigate complex multi-step semantic code paths in core C/C++ libraries, runtimes, and hypervisors, targeting memory corruption and logic flaws. In GTIG's own words, "AI models excel at identifying memory corruption (buffer overflows, use-after-free) and logic bypasses that traditional static analyzers consistently miss." In other words, automation is targeting the defect classes that actually lead to RCE, because that's where the money is. Embedded in this finding is the warning case of CVE-2026-1731, an unauthenticated OS command injection in BeyondTrust privileged remote access, autonomously discovered by a third-party research agent: within four days of disclosure, a threat cluster exploited it, and within seven days, five more clusters conducted post-exploitation, including privilege escalation, data theft, and secondary payloads like SNOWLIGHT, SPARKRAT, and a cryptominer.

The unsettling loop closes when GTIG's data on vulnerabilities targeting the AI stack itself is added: 2,076 cumulative AI-related CVE disclosures between January 2025 and August 2026, over 1,500 of them in 2026 alone, concentrated in orchestration frameworks (782, half of all AI-related defects, a 347% surge) and inference/serving infrastructure (212). The same technology driving faster, higher-severity discovery is itself the fastest-growing attack surface — GTIG explicitly warns this dual exposure corresponds to "exactly the defect types sophisticated adversaries are actively seeking to exploit."

Remote Code Execution (RCE) and memory corruption: RCE is one of the highest-impact vulnerability exploitation categories, allowing an attacker to execute arbitrary code on a target system with the victim process's privileges. Memory corruption defects — buffer overflows, use-after-free, out-of-bounds read/write — are the primary source of RCE, long present in core libraries, runtimes, and hypervisors written in C/C++. Traditional static analyzers, needing to balance precision against false positive rates, often struggle to cover multi-step semantic paths, whereas AI agents can traverse deeper call chains and state spaces — this is the structural reason GTIG observed that 50% of AI-discovered vulnerabilities lead to RCE.

AI stack attack surface: Orchestration frameworks (such as LangChain, AutoGen, etc.) handle model invocation scheduling, tool execution, and state management, while inference/serving infrastructure (such as vLLM, Triton, etc.) handles model loading and request distribution. These two layers directly expose APIs and management interfaces, and many deployments lack authentication or use default configurations. Of the 2,076 AI-related CVEs, orchestration frameworks account for 782 with a 347% surge, indicating attackers are treating the AI stack itself as a high-value target — able to both steal models and data and hijack the inference process.

A New Foothold for Triage

The defensive prescription is written directly from the data: triage by exploitation risk, not by patch volume. With 10,740 disclosures in a single month and a 0.23% exploitation rate, no team can patch by volume; the control point is threat-intelligence-driven triage, combining targeted edge defense with automated remediation where the data shows risk is concentrated. GTIG's own recommendation is to "shift from unprioritized mass patching to threat-intelligence-driven triage, combining targeted edge defense with automated, agentic remediation," plus internal pre-release review of AI code so defects are fixed before they enter the disclosure world.

The edge device numbers give triage a concrete starting point. Vulnerabilities in edge and security devices account for 14% of exploited vulnerabilities, over 65% of exploited edge defects reach high/critical threat risk ratings, and adversaries "actively target unauthenticated public management interfaces." If you had to pick a direction to invest in over the next hour, it's this slice: boundary devices combining high severity and unauthenticated reachability — exactly the management plane lesson this blog drew from NVIDIA infrastructure controller disclosures, now supported by aggregate data rather than a single advisory.

The dataset's honest limitations matter as much as its findings, and GTIG states them clearly: public CVE repositories still lack unified AI attribution metadata, so AI discovery data is partial, and "confirmed exploitation of AI-discovered vulnerabilities suggests the increased risk from AI-discovered defects is not purely theoretical" is only an early indicator, not an established trend. Treat the 50% RCE figure as a directional signal. But the direction is consistent across all tables: volume inflates, the exploited slice concentrates upward, and the defect classes AI discovers are exactly those attackers are already hunting. This is the triage map for the year ahead.

Originally published on the Netics blog.

Threat-intelligence-driven triage: The core logic is to use external intelligence to determine which vulnerabilities have actually been exploited or are active in the wild, prioritizing those for remediation rather than ranking by CVSS score or disclosure volume. Concrete practices include: subscribing to exploited vulnerability lists (such as CISA KEV), correlating with your own asset exposure surface, and auditing reachability of edge device management interfaces. GTIG's recommended "targeted edge defense" means implementing stricter access controls and rapid remediation for boundary devices (VPNs, firewalls, router management interfaces), because data shows 14% of exploited vulnerabilities concentrate in these locations, and most have unauthenticated reachability.

Agentic remediation: This refers to using AI agents to automatically handle patch identification, dependency analysis, testing, and deployment, compressing the remediation window. This creates symmetric competition with attackers using AI to weaponize n-days — defenders equally need automation to keep pace. GTIG also recommends security review of AI-generated code before release, intercepting defects before they enter the disclosure world.

One-line Summary

GTIG data shows vulnerability disclosures doubled but only 0.23% were exploited, requiring a shift to threat-intelligence-driven triage.

Paragraph Summary

GTIG's first AI-era vulnerability dataset shows disclosures doubled from 5,045 to 10,740 between January and August 2026, but only 141 (0.23%) were actually exploited, with raw volume severely inflated by automated CNA numbering. Exploited vulnerabilities concentrate upward: rapid n-day weaponization is the main growth driver, with AI making diff analysis and exploit development more efficient; zero-days still account for 62% of exploited vulnerabilities. AI-discovered vulnerabilities have a different profile, with 50% leading to RCE versus 26% traditionally, skewing toward memory corruption and logic bypasses in core C/C++ libraries. Meanwhile the AI stack itself is the fastest-growing attack surface, with orchestration frameworks accounting for half of AI-related CVEs. The defensive prescription is to abandon patching by volume and shift to threat-intelligence-driven triage, prioritizing unauthenticated, reachable high-risk vulnerabilities in edge devices.