Findings/ai-finds-real-vulnerabilities

AI systems find real, previously unknown vulnerabilities in widely used open-source software.

Corroboratedobserved6 evidence records from 6 independent sourcesassistant-drafted

Scope: what this does not show

Counts are mostly reported by the organizations that built the systems; individual CVEs confirm specific cases.

Corroborated: Supported by at least two independent sources.

Evidence

Nov 1, 2024

Google's Big Sleep agent finds exploitable stack buffer underflow in SQLite before release

Google Project Zero

Nov 20, 2024

OSS-Fuzz AI-generated fuzz targets find 26 vulnerabilities, including OpenSSL CVE-2024-9143

Google Security Blog

Aug 8, 2025

AIxCC final: Team Atlanta wins as systems patch 43 of 54 found synthetic bugs and find 18 real ones

DARPA

Jan 27, 2026

All 12 CVEs in OpenSSL's January 2026 advisory credited to AISLE, which says its AI system found them

OpenSSL

Feb 5, 2026

Anthropic reports over 500 human-validated high-severity open-source vulnerabilities found with Claude Opus 4.6

Anthropic Frontier Red Team

May 22, 2026

Glasswing update: over 10,000 high-severity bugs found, but only 75 of 530 disclosed OSS bugs patched

Anthropic

Key questions that rely on this finding

Is AI shifting the balance between finding and fixing vulnerabilities?Discovery is ahead. AI finds real vulnerabilities faster than they are fixed, and simple checks overstate how often AI patches work.

Status history

2024-11-01ReportedBig Sleep finds an exploitable SQLite bug. · record
2025-08-08CorroboratedAIxCC finalists find 18 real vulnerabilities. · record

What would change this: Independent audits of AI-reported vulnerability counts.
Evidence kind: observed: Seen in a real incident or operation.
Freshness: Evidence 127d old · recheck in 413 daysNewest evidence May 22, 2026. Half-life 540 days.
Methods tested: AI vulnerability discovery for defense
Topics: Vulnerability discovery
Fide research: FID-088: Independent verification of autonomous cyber repairs

Cite this record

Fide AI. "AI systems find real, previously unknown vulnerabilities in widely used open-source software.." Agentic Cyber Explorer, record ai-finds-real-vulnerabilities. https://agentic-cyber-explorer.pages.dev/findings/ai-finds-real-vulnerabilities/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-ai-finds-real-vulnerabilities,
  author = {{Fide AI}},
  title = {AI systems find real, previously unknown vulnerabilities in widely used open-source software.},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/findings/ai-finds-real-vulnerabilities/},
  note = {Record ai-finds-real-vulnerabilities; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Know of evidence that changes this? Tell us.