AI Found the Bugs: 23,000 Findings in a Month, a 3-Day Patch Mandate, and the End of curl's Bounty

I have been on the receiving end of the change this post is about. In the last year the security reports arriving at my platform's address went from a few careful emails to a steady stream, most of them wrong, some of them very good, and nearly all of them written with help from a model. So I went back through the record, from DARPA's competition last August to the disclosures of this summer, to work out what the machines can actually find, what they are being used for on the other side, and what a team without a security department should do about it. It is a long record and the numbers in it are large.

The competition that started the clock

DARPA's AI Cyber Challenge ended at DEF CON on 8 August 2025. Seven teams had built cyber reasoning systems, autonomous pipelines that take a codebase, find vulnerabilities and write patches, with the frontier labs providing model credits. Over the final, per DARPA's results, the systems analysed 54 million lines of code, found 54 of 63 injected vulnerabilities and patched 43, and found 18 previously unknown real bugs and patched 11, at an average patch time of 45 minutes and an average cost of about $152 per task. Team Atlanta won $4 million; Trail of Bits, whose Buttercup used only standard non-reasoning models and over 100,000 LLM requests, took $3 million; Theori took $1.5 million. All seven systems were open-sourced.

What happened next is the more useful data. A March 2026 paper that tried to run the seven systems found "all seven open-sourced CRSs remain largely unusable outside their original teams", tied as they were to specific Azure and Kubernetes setups; when the authors ported Team Atlanta's and gave it 24 hours each on eight OSS-Fuzz projects, it found ten new bugs, three of them high severity. The OpenSSF formed a working group and now hosts a portable version; its tally in May was 62 vulnerabilities found by one system across 26 projects, 25 by another, and 22 zero-days in the kernel and userspace by a third. Buttercup runs on a laptop. If you maintain a C or C++ project, there is now a free program that will find memory-safety bugs in it overnight.

The labs

Google went first and stayed quiet. Big Sleep, Project Zero's collaboration with DeepMind, found an exploitable stack underflow in SQLite in October 2024 that 150 CPU-hours of fuzzing had missed. In July 2025 it found CVE-2025-6965, a critical SQLite bug that Google's threat intelligence group knew was being staged for exploitation but could not locate; Google called it the first time an AI agent had foiled an in-the-wild exploitation attempt. In August 2025 it reported a batch of twenty, mostly in FFmpeg and ImageMagick, with "a human expert in the loop before reporting" but each bug found and reproduced without one. Since then there is nothing: no Project Zero post in 2026 mentions Big Sleep, and the transparency tracker does not attribute by researcher. CodeMender, DeepMind's patching agent, had upstreamed 72 fixes by October, including bounds-safety annotations to libwebp that would have neutralised the zero-click iOS bug of 2023.

OpenAI shipped a product. Aardvark, announced in October 2025 with 92% recall on repositories seeded with known bugs, became Codex Security in March; in its first thirty days of beta it analysed 1.2 million commits and reported around 800 critical and 10,000 high-severity findings. The numbers OpenAI chose to publish alongside are the honest ones: noise down 84% on repeat scans, over-reported severity down 90%, false positives down 50%. A scanner that has to cut its noise by 84% to be usable started out mostly noise. OpenAI also created a tiered access programme, identity-verified defenders getting cyber-tuned models with relaxed refusals, GPT-5.4-Cyber in April, 5.5-Cyber in May, and GPT-5.6-Cyber on 11 August under a scheme with a permissive "Red" tier and a guarded "Blue" tier: 95% completion on their advanced cyber tasks against 1.5% for the general model.

Anthropic made the disclosure that reset the field. On 7 April it announced Claude Mythos Preview and declined to release it generally, citing exploitation capability. The findings it published: a 27-year-old denial-of-service in OpenBSD's TCP SACK handling, found for under $20,000 across a thousand runs; a 16-year-old heap write in FFmpeg's H.264 decoder for about $10,000; a 17-year-old unauthenticated root remote code execution in FreeBSD's NFS server, CVE-2026-4747; a guest-to-host escape in a memory-safe hypervisor; and "over 1,000 critical-severity and thousands of high-severity" bugs across open source. In the evals, Firefox JavaScript exploit attempts succeeded 181 times against two for the previous model. Access went to twelve partners including AWS, Apple, Cisco, CrowdStrike, Google, the Linux Foundation and Microsoft under Project Glasswing, with $100 million in credits and grants to the open-source security foundations. The May update: 23,019 issues across more than a thousand open-source projects, 6,202 of them high or critical, over 90% of a validated sample confirmed genuine, and Anthropic's stated bottleneck "the relative ease of finding vulnerabilities compared with the difficulty of fixing them."

I will add the sceptical note, which also comes from the record. AISLE, a security startup, showed the same day that eight of eight cheap open-weight models detected the FreeBSD NFS flaw once pointed at the right function, one of them at $0.11 per million tokens; their line was that "the moat is the system, not the model." And a claim I could not confirm from the primary, attributed to the system card, is that the Firefox successes mostly relied on the same two since-patched bugs. Both things can be true: the model is exceptional at exploitation, and the discovery half is increasingly reproducible with cheaper components plus good harnessing, which is what AIxCC demonstrated with 2025's models.

The other side

The attackers' timeline runs in parallel. Anthropic's August 2025 threat report described an actor using Claude Code to run data-theft and extortion against at least seventeen organisations, with the model making "tactical and strategic decisions" about what to steal and how to word the ransom notes; demands ran to over $500,000. Its November disclosure was the one that got the congressional hearing: a Chinese state-sponsored group, detected in mid-September, that jailbroke Claude Code by decomposing the intrusion into innocuous tasks and posing as a security firm, then had it perform 80 to 90% of a campaign against about thirty targets, with "a small number" of successful intrusions. The model occasionally hallucinated credentials, which is the kind of detail that tells you it is a real report.

Google's threat group has been tracking malware that calls a model at runtime: PROMPTFLUX, a script that asks Gemini hourly to rewrite itself, and PROMPTSTEAL, used by APT28 in Ukraine, which queries an open-weight coding model on Hugging Face for the Windows commands it runs. On 12 May they reported what they called the first AI-generated zero-day exploit in the wild: a two-factor bypass in a widely used open-source web administration tool, a logic flaw in a hard-coded trust assumption, prepared for mass exploitation. And Palo Alto's 2026 incident report, from over 750 engagements, put the fastest observed time from initial access to data exfiltration at 72 minutes, four times faster than the year before. The median time from CVE publication to exploitation was 63 days in 2018. It was five days in 2025.

CISA's answer arrived on 10 June as Binding Operational Directive 26-04: federal agencies must patch within three days any vulnerability that is on the known-exploited list, internet-exposed, automatable and grants control of the system. The quote from CISA's technical lead was that "defenders cannot afford to take weeks to patch systems that can be autonomously exploited en masse." Three days is a policy written for a world where the exploit is generated the afternoon the patch lands.

The people in the middle are drowning

The cost of cheap finding lands on the humans who triage. Daniel Stenberg ended curl's bug bounty on 31 January after seven years, 87 confirmed vulnerabilities and over $100,000 paid; his post says the confirmation rate had been "north of 15%" historically and fell "below 5%" in 2025, and that the "never-ending slop submissions take a serious mental toll." HackerOne's 2025 report has the other half: $81 million paid, a 210% rise in valid AI-related reports, a 540% rise in prompt-injection reports, and "560+ valid reports submitted by autonomous agents", which it called the start of the hackbot arms race. XBOW's agent topped HackerOne's US leaderboard in 2025 and the company raised $120 million in March at over a billion. The bounty platforms have found a way to make the flood pay; the solo maintainers have not.

The public record is straining too. There were 48,185 CVEs in 2025, up 20.6%, about 132 a day; the Linux kernel alone, which became its own numbering authority in 2024, issued 5,686 and is on pace for about 7,600 this year. The CVE programme itself nearly lost its funding on 16 April 2025 and was extended the same day. On 15 April this year NIST gave up on full enrichment: every backlog CVE published before 1 March was reclassified as "Not Scheduled", and priority now goes to exploited, federal and critical-software entries only. If your vulnerability scanner depends on NVD severity scores, a growing share of what it sees has no score and never will.

What a small team should do

I am a one-person security department for a multi-tenant platform, so this is what I actually run, in order of how much human attention it costs.

1. Deterministic scanners on every PR, with a model triaging their output. Semgrep or CodeQL first, because their false positives are at least consistent. Semgrep's own data, from 250,000 findings across 45 customers, is that a model auto-filters about 20% as false positives at 95% agreement with humans. That is the model doing the job it is good at, reading a finding in context, rather than the job it is worse at, inventing findings.
2. A model review of the diff, with a suppression file. Anthropic's security review runs as a GitHub Action and comments inline; Codex Security is the equivalent on the other side. Both need a repository-specific list of things that look like bugs and are not, or the third week of comments will be ignored along with the ones that matter. GitHub's numbers for model-generated fixes, a median 28 minutes to fix a scanner alert against an hour and a half by hand, are from 2024 and the acceptance rate has never been published; I find the fix suggestions right often enough to read and wrong often enough to never auto-merge.
3. A weekly reasoning-system run on the parser-heavy code. Buttercup, or OSS-Fuzz if the project is eligible. The bugs that AIxCC-style systems find are memory-safety bugs in C and C++, and if you have none of that, skip this step.
4. A reproduction before a ticket. This is the rule that fixed my inbox: no finding, from a person or a program, becomes a ticket until there is a proof-of-concept that runs in a sandbox. The external reports that survive it are the good ones, and the reporters who can produce one are the ones worth paying. Anthropic's finding that patching is now the bottleneck, and OpenAI's 84% noise reduction, both say the same thing: validation is the scarce step, so put it before the human.
5. Measure time-to-fix, not findings. The number that changed under BOD 26-04 is days from disclosure to patch, and it is the number that matters when the exploit is written the same afternoon. GitHub's move from 37 to 26 days for critical fixes is the benchmark I use.

The honest summary is that finding bugs got cheap in 2025 and 2026, for everyone, and that every other part of the process, triage, validation, patching, coordinated disclosure, the public record, was built for the old price. The labs that found the most bugs say fixing them is now the hard part. The maintainers say reading the reports is. CISA says three days. All of them are describing the same shortage of human hours at the point where the machine's output meets the codebase, and that is where I would spend an engineering budget this year.

Related: The Worms Learned to Use Your AI Agent, MCP Security in 2026 and Isolation Is Not an Abuse Control.