AI vulnerability discovery outpaces human remediation

The discovery surge. Security researchers and AI labs report that frontier models now identify and weaponize vulnerabilities in hours, a process that once required months of human effort (a16z, Resilient Cyber). Anthropic demonstrated an unreleased model writing exploits for Linux kernel bugs and Chrome sandbox escapes, while OpenAI models identified critical flaws in PHP that underpin 70% of the web (LearnAIWithMe). This capability has led some analysts to warn of a 'vulnerabilities tsunami' where the velocity of machine-led discovery collapses the time available for defenders to patch infrastructure (John Naughton from Memex 1.1).

The remediation plateau. Conversely, industry observers argue that the threat of a 'Vulnpocalypse' remains speculative because actual exploitation rates have not spiked in proportion to the volume of published vulnerabilities (Resilient Cyber, Resilient Cyber). Data from the Verizon Data Breach Investigations Report shows the median time to fully fix a known-exploited vulnerability has actually increased to 43 days, suggesting that the bottleneck is not the discovery of flaws but the operational capacity to deploy patches. Proponents of this view point to the resilience of core internet infrastructure, which remains robust despite the increased availability of exploit code (a16z).

Operational reality. The tension between these perspectives centers on whether security investments should prioritize rapid vulnerability identification or the structural hardening of systems to survive inevitable breaches (Software Analyst Cyber Research). While AI-assisted scanning tools offer teams a way to map assets and identify critical holes, the persistent delay in applying fixes across the 'long tail' of small operators and legacy systems indicates that automated discovery alone cannot substitute for fundamental architectural changes like microsegmentation and identity management (TL;DR Sec, LearnAIWithMe).