AI Is Finding Security Holes Faster Than Anyone Can Fix Them — What That Means for You

New research published today puts a specific number on a problem that’s been growing for months: AI discovers vulnerabilities up to 16.5 times faster than the security industry can make them visible, let alone patch them. Here’s what that gap actually means in plain English.

Your software gets security updates. You install them, or your device installs them automatically. That system — discover a vulnerability, publish it, patch it, deploy it — has worked reasonably well for decades. It is now under pressure from a new direction: AI models that can find vulnerabilities far faster than that pipeline can process them. Research published today quantifies exactly how wide that gap has become, and the numbers are significant enough to be worth understanding — whether you run a website, use IoT devices at home, or simply use a browser every day.

The 2026 Verizon Data Breach Investigations Report covers patch gaps and AI’s role in cybercrime — directly relevant background to the vulnerability discovery gap covered in this article. Not a Wangdoo production.

The Numbers Behind the Gap

Anthropic’s Claude Mythos Preview — a restricted AI model available only to vetted organisations as part of Project Glasswing — was made available to its first partners in April 2026. In its first 63 days, Mythos disclosed 1,596 verified vulnerabilities across 281 open-source projects. That is not a small number. Cloudflare, one of those partners, found 2,000 bugs, 400 of which were high or critical severity. Mozilla found and fixed 271 vulnerabilities in Firefox alone — ten times more than a previous Claude model found in an older browser version.

The specific problem Tuskira’s research published today identifies: 95% of those Mythos-disclosed vulnerabilities had no public advisory at the time of discovery. Standard CVE databases, vulnerability scanners, and the security tools most organisations depend on had no record of them. The gap between AI finding a vulnerability and the standard advisory system catching up is currently 16.5 times — meaning for every one vulnerability visible in the normal pipeline, AI has already found 16 more that most security tools haven’t processed yet.

What “90 to 150 Days” Actually Means

Even when a vulnerability does get through the standard disclosure pipeline — found, published as a CVE, picked up by scanners, included in patch bulletins — the end-to-end window from private disclosure to a patch actually deployed in enterprise production typically runs 90 to 150 days. That’s the window during which a vulnerability is known to exist but not yet fixed, in organisations that are actively trying to fix it.

The Zero Day Clock project — a live dashboard tracking 3,500+ confirmed CVE-exploit pairs from sources including CISA KEV and VulnCheck KEV — puts the time-to-exploit collapse into specific numbers. In 2018, the median time from vulnerability disclosure to first confirmed exploitation in the wild was 771 days. Organisations had over two years to patch. By 2023 that window was down to 6 days. By 2024 it was 4 hours. In 2026, the Zero Day Clock shows just over a day as the current median for actively exploited vulnerabilities, with projections of under one hour by 2027. The Zero Day Clock also tracks that 68% of exploited vulnerabilities in 2026 are zero-days — meaning exploitation happened before or on the same day as public disclosure. An organisation slow to apply patches is not just behind — for most exploited vulnerabilities, disclosure itself now triggers exploitation before most security teams have read the advisory.

The Ripple Effect — One Vulnerability Becomes Many

There is a second layer to this problem that Tuskira’s research specifically flags. When AI finds a vulnerability in a widely used component, it doesn’t just affect that component — it propagates through everything built on top of it. The report cites a single ImageMagick CVE (ImageMagick is a widely used image-processing library) that propagated to 18 or more NuGet package variants via Magick.NET. One upstream vulnerability triggered many downstream alerts across different packages, frameworks, and applications — all of which needed separate assessment and patching.

This is the dependency chain problem in concrete terms. Most modern applications don’t just run their own code — they pull in dozens or hundreds of third-party libraries, which themselves pull in further dependencies. A vulnerability anywhere in that tree can affect the entire application. The average npm project (the JavaScript package ecosystem used by most web applications) pulls in 79 transitive dependencies. If any one of those has a newly discovered vulnerability, it may not appear in standard scanners for days, weeks, or months.

Does This Actually Affect You — or Just Large Enterprises?

This is the question worth answering honestly. The research is framed around enterprise security teams and CISOs, but the underlying software vulnerabilities affect anyone using the software in question.

For individuals, the most actionable implication is straightforward: software updates matter more than they used to, and enabling automatic updates wherever possible reduces the window during which a known vulnerability exists on your device. For anyone running their own website, server, or application — even at a small scale — the dependency chain problem is worth taking seriously. Outdated plugins, themes, and libraries are the entry point for a significant proportion of successful attacks.

A Current WordPress Example Worth Knowing About

As of June 20, 2026, The Hacker News reported active exploitation of CVE-2026-4020 in the Gravity SMTP WordPress plugin — a vulnerability that exposed API keys, OAuth tokens, and mail-configuration secrets. This is a standard CVE, not a Mythos-discovered vulnerability, but it illustrates the same pattern clearly: a plugin vulnerability being exploited in the wild during the window between public disclosure and when most site owners had applied the available patch. For anyone running WordPress, it is a current, concrete reason to check your plugin update status.

What Actually Helps

How Website Owners and IoT Users Can Use AI to Protect Themselves

The same AI capability accelerating vulnerability discovery is also available to defenders — including individuals and small business owners who don’t have enterprise security teams. These are specific, accessible tools, not theoretical suggestions.

For WordPress and Website Owners

• Patchstack — a WordPress-specific vulnerability intelligence service that monitors your installed plugins and themes against a real-time database of known vulnerabilities. The free Personal plan monitors your site and alerts you when installed plugins or themes have known CVEs, and can flag vulnerabilities up to 48 hours before they’re publicly disclosed. Virtual patching — which blocks exploitation at the firewall level before the official fix is available — requires the paid plan. For a single site, the free monitoring tier is still genuinely useful as an early warning system; virtual patching is the reason to upgrade.
• Wordfence — a widely used WordPress security plugin with a built-in firewall and malware scanner. Its Threat Intelligence Feed includes newly identified attack patterns within hours of detection. The free version updates weekly; paid updates arrive in real time.
• Cloudflare’s free plan — sitting Cloudflare in front of your website (free to set up) provides a web application firewall layer that blocks known exploit patterns. When a new vulnerability is discovered in widely used software, Cloudflare typically deploys WAF rules against it before most site owners have applied the underlying patch.

For IoT Devices — Routers, Smart Home, CCTV

• Keep firmware updated and enable auto-update where available. Most IoT device compromises exploit firmware vulnerabilities that vendors have already patched — the device simply wasn’t updated. IoT devices are particularly exposed because they often run older, embedded software with long patch cycles and owners rarely check for updates manually.
• Segment your IoT devices onto a separate network. Most home routers support a guest network — putting smart home devices, CCTV cameras, and other IoT hardware on a separate SSID from your main computers means a compromised IoT device cannot easily reach your other devices. This is the single highest-impact structural change most home users can make. If you’re evaluating security cameras specifically, local AI processing cameras that don’t rely on cloud infrastructure also reduce your exposure surface significantly.
• Use a router with active security features. Some consumer routers (ASUS AiProtection, Netgear Armor, and others) include real-time threat intelligence feeds that block known malicious traffic at the network level — effectively a household-scale WAF. These features are increasingly standard on mid-range routers.
• Audit connected devices regularly. Check your router’s connected device list periodically. Unknown devices, or devices that haven’t been updated in over a year, are the first place to investigate. Free tools like Fing (available as an app) can scan your network and flag outdated or potentially vulnerable devices.

Free AI-Assisted Scanning Tools Available Now

• Mozilla Observatory (observatory.mozilla.org) — scans any public website for security misconfigurations, missing security headers, and known issues. Free, no account required, takes under a minute.
• Snyk — if you manage any code or web application, Snyk’s free tier scans open-source dependencies for known CVEs and provides fix recommendations. Integrates with GitHub and most code editors.
• Have I Been Pwned (haveibeenpwned.com) — not vulnerability scanning, but directly relevant: checks whether your email address or domain has appeared in known data breaches. Free, run by independent security researcher Troy Hunt.

Frequently Asked Questions

Clayton Samuel (Mr Wangdoo), QFA

Founder & editor, Wangdoo.com. Qualified Financial Adviser with a background in electronics, web development, and cloud infrastructure. Manages Wangdoo’s own hosting, DNS, and server security directly.