Google: AI Doubles Monthly Vulnerability Disclosures, Shifts Exploit Profile in 2026

September 30, 2026 at 07:05 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Monthly vulnerability disclosures doubled to 10,740 in August 2026, and exploited vulnerabilities rose to 18 per month, Google Threat Intelligence Group reported September 30. AI-discovered flaws were more likely to enable remote code execution, at 50% versus 26% for others. Zero-day exploitation rose only marginally, even as n-day weaponization accelerated.

Key Facts

Monthly vulnerability disclosures rose from 5,045 in January 2026 to 10,477 in July and peaked at 10,740 in August, according to Google Threat Intelligence Group.
GTIG recorded 141 distinct exploited vulnerabilities in the first eight months of 2026, exceeding the 127 seen in all of 2025.
50% of vulnerabilities GTIG identified as likely AI-discovered resulted in remote code execution, compared with 26% of non-AI vulnerabilities.
Zero-day exploitation averaged 11 per month in 2026, up from 8 per month in 2025, with a jump to 22 in August.
High-risk disclosures based on GTIG's own ratings grew 167%, from 131 in January to 350 in August 2026.

Disclosure Surge

Google Threat Intelligence Group analyzed vulnerability disclosures from January 2025 through August 2026. Monthly disclosures climbed from 5,045 in January 2026 to 10,477 in July, reaching 10,740 in August. GTIG cautioned that raw volume can be misleading because automated CVE assignment in open source ecosystems inflates numbers. Vulnerabilities mentioning the Linux kernel alone generated roughly 5,000 CVEs between January and August, with no observed in-the-wild zero-day exploitation.

Exploitation Trends

GTIG recorded 141 distinct exploited vulnerabilities in the first eight months of 2026, more than the 127 seen in all of 2025. The monthly average of exploited vulnerabilities rose from 10.5 in 2025 to 18 in 2026. Zero-day exploitation increased only marginally, from an average of eight per month in 2025 to 11 per month in 2026, though the count jumped to 22 in August. Zero-days made up 62% of the vulnerabilities exploited between January and August. GTIG suggested the growth in exploitation came primarily from n-days, with threat actors possibly using LLMs and AI tools to automate analysis of patches and proof-of-concept code.

AI-Discovered Vulnerability Profile

Vulnerabilities GTIG identified as likely discovered by AI between January and August show a different risk profile. Of these, 39% were rated low-risk and 58% medium-risk, compared to 69% and 28%, respectively, for non-AI vulnerabilities. GTIG said this likely reflects how research programs deploy AI agents, tasking them with auditing critical infrastructure and sensitive privilege boundaries. Half of the AI-discovered vulnerabilities result in remote code execution, compared to 26% of non-AI vulnerabilities. GTIG attributed this to AI models' ability to find memory corruption and logic flaws that traditional static analyzers miss.