{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/findings/ai-finds-real-vulnerabilities/",
 "asOf": "2026-09-26",
 "id": "ai-finds-real-vulnerabilities",
 "claim": "AI systems find real, previously unknown vulnerabilities in widely used open-source software.",
 "evidenceKind": "observed",
 "scope": "Counts are mostly reported by the organizations that built the systems; individual CVEs confirm specific cases.",
 "topics": [
  "vulnerability-discovery"
 ],
 "atlas": [],
 "evidence": [
  {
   "event": "google-big-sleep-sqlite-first-vulnerability-2024"
  },
  {
   "event": "google-oss-fuzz-ai-26-vulnerabilities-2024"
  },
  {
   "event": "darpa-aixcc-final-results-2025"
  },
  {
   "event": "aisle-openssl-january-2026-advisory"
  },
  {
   "event": "anthropic-opus-4-6-500-zero-days-2026"
  },
  {
   "event": "anthropic-glasswing-initial-update-2026"
  }
 ],
 "relations": [],
 "statusHistory": [
  {
   "status": "reported",
   "on": "2024-11-01",
   "why": "Big Sleep finds an exploitable SQLite bug.",
   "event": "google-big-sleep-sqlite-first-vulnerability-2024",
   "kind": "evidence"
  },
  {
   "status": "corroborated",
   "on": "2025-08-08",
   "why": "AIxCC finalists find 18 real vulnerabilities.",
   "event": "darpa-aixcc-final-results-2025",
   "kind": "evidence"
  }
 ],
 "halfLifeDays": 540,
 "wouldChange": "Independent audits of AI-reported vulnerability counts.",
 "fideQuestions": [
  "FID-088"
 ],
 "methods": [
  "ai-vulnerability-discovery"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}