GTIG (1 Oct): vulnerability discovery & exploitation trends in the AI era — disclosures doubled; AI-found bugs skew to RCE
Google Threat Intelligence Group (GTIG) report “Vulnerability Discovery and Exploitation Trends in the AI Era” (published 1 October 2026; SecurityWeek amplify 30 Sep ahead of/with release) analyses Jan 2025–Aug 2026 disclosure and exploitation telemetry. Monthly CVE disclosures roughly doubled in 2026 (e.g. ~5,045 in January → ~10,477 in July, peak ~10,740 in August); GTIG cautions open-source CNA inflation (Linux kernel description alone ~5,000 CVEs Jan–Aug with zero observed in-the-wild zero-days). GTIG high-risk disclosures grew 167% (131 in Jan → 350 in Aug). Distinct exploited vulnerabilities: 141 in first eight months of 2026 vs 127 in all of 2025 (~18/month vs ~10.5). Only ~0.23% of 2026 disclosures observed exploited. Zero-day exploitation rose modestly (~8/month 2025 → ~11/month 2026; 22 in August); 62% of exploited vulns Jan–Aug were zero-days — growth also from faster n-day weaponisation (GTIG hypothesises LLM-assisted patch/diff analysis). AI-discovered vulns show different risk profile (more medium/high vs non-AI) and ~50% lead to remote code execution vs ~26% non-AI. Confirmed in-the-wild exploitation of some AI-discovered vulnerabilities described as an early indicator. Primary: Google Cloud / GTIG blog 1 Oct; wire: SecurityWeek.
- Product
- Vulnerability disclosure & exploitation landscape (AI-assisted discovery / n-day weaponisation) — GTIG analysis
- Versions
- n/a — research covering Jan 2025–Aug 2026 telemetry (report dated 1 Oct 2026)
- Exploited in Australia?
- unknown
- Patch to
- No single CVE. Defenders: prioritise GTIG/Mandiant high-risk and actively exploited sets over raw CVE volume; assume faster n-day turnaround; track AI-stack and memory-corruption RCEs. Patch internet-facing apps on exploited/high-risk lists first; do not treat Linux-kernel CVE count alone as exposure.
Primary: Google Cloud / GTIG — Vulnerability Discovery and Exploitation Trends in the AI Era (1 Oct 2026) · Vendor: Google Threat Intelligence Group (primary research) · SecurityWeek — Google: AI changing pace/profile of vuln discovery (30 Sep 2026)