AI bug hunting drives 66,401 CVEs as slowdown talks stall

The newsletter Kernel Panic debuts with a focus on how AI is reshaping digital security. For years, AI doomers worried about a software vulnerability apocalypse, but the article notes that concern has shifted toward rogue AI causing mass human death. Meanwhile, the vulnerability wave from existing AI tools has already arrived.

The numbers back this up. Microsoft's 974 CVE patches in one month set a record. Oracle shipped 1,448 patches in July, compared to 309 in July 2025. Google Chrome's two major June releases included 1,072 patches, more than all fixes in the prior 23 big releases combined. Mozilla found 271 vulnerabilities in Firefox in one sprint using Anthropic's Mythos model. Overall, cve.icu has logged 66,401 CVEs this year, nearly double the 33,512 recorded by September 16 last year.

Experts are divided on whether this is catastrophic or just magnifying existing dynamics. Jerry Gamblin of Empirical Security argues more CVEs means more known vulnerabilities, which is mostly the system working. But the fear is that patching cannot keep up. As Gamblin puts it, discovery scales with compute, while remediation scales with people. The stakes hinge on whether defenders can use AI as effectively as attackers, and whether under-resourced security teams can close the gap.