Discovery is ahead. AI finds real vulnerabilities faster than they are fixed, and simple checks overstate how often AI patches work.
AI systems find previously unknown vulnerabilities in widely used open-source software, and one lab’s program data shows disclosure far ahead of patching. Checking only that the original crash no longer reproduces overstates how often AI-generated patches actually fix the flaw. Independent patch verification is the bottleneck the evidence points to.
The findings behind it
3 corroboratedEach finding carries a status that changes as new work arrives. What the statuses mean.
- AI systems find real, previously unknown vulnerabilities in widely used open-source software.Corroborated observed · 6 evidence records
- AI-driven vulnerability discovery produces reports faster than maintainers can triage and patch them.Corroborated reported · 2 evidence records
- Checking only that the original crash no longer reproduces overstates how often AI-generated patches actually fix the vulnerability.Corroborated measured · 2 evidence records
Answer history
Answers are never edited after the fact. A revision adds a new answer and keeps the earlier ones here.
- 2026-09-25moderate confidencecurrentDiscovery is ahead. AI finds real vulnerabilities faster than they are fixed, and simple checks overstate how often AI patches work.First answer, drawn from the findings linked here.