Google says monthly CVE disclosures doubled in 2026 as AI finds more serious bugs

What Google found

Google Threat Intelligence Group (GTIG) published an analysis of vulnerability trends in the AI era on 30 September 2026. It covers vulnerabilities disclosed from 1 January 2025 to 31 August 2026 and uses GTIG's own risk ratings rather than CVSS scores. The authors are Robin Grunewald, Supriya Mazumdar and Kelli Vanderlee.

Monthly disclosures doubled from 5,045 in January 2026 to 10,477 in July and reached 10,740 in August. GTIG warns that raw counts mislead: descriptions mentioning the Linux kernel alone produced about 5,000 CVEs between January and August with no exploited zero-days. High-Risk disclosures rose from 131 in January to 350 in August, still only 3% of the total. Bursts from TOTOLINK router firmware and from Oracle and Linux advisories drove much of that growth.

Exploitation grows, zero-days less so

GTIG recorded 141 vulnerabilities exploited in the wild from January to August 2026, more than the 127 for all of 2025. The monthly average rose from 10.5 to 18. Only 0.23% of 2026 disclosures, about 1 in 431, were seen exploited. Zero-days rose from 8 to 11 a month on average, though August jumped to 22. Exploitation of High-Risk flaws more than doubled, from 28 in 2025 to 75 this year. GTIG suggests attackers may be using AI to turn patches and public proofs of concept into working n-day exploits faster.

Edge and security appliances made up 14% of exploited vulnerabilities and enterprise directory and collaboration systems 11%. Over 65% of exploited edge flaws carried High or Critical ratings.

AI as hunter and as target

Among CVEs GTIG could identify as likely found by AI, 58% rated Medium risk and 39% Low, compared with 28% and 69% for other CVEs. Half lead to remote code execution, against 26% across the wider ecosystem. GTIG says public data undercounts AI discovery because CVE records lack an AI tag and cloud providers often fix such bugs without CVEs. One example is CVE-2026-1731 in BeyondTrust remote access products, found by Hacktron AI's agent. GTIG saw one threat cluster exploit it within four days of disclosure and five more within seven days.

GTIG also tracked 2,076 AI-related CVEs since January 2025, over 1,500 of them in 2026. Agent orchestration frameworks such as Flowise, Langflow and LangChain account for 50% and saw disclosures rise 347% in 2026. Inference servers such as vLLM, Ollama and LiteLLM had 212. GTIG counts 97 in frontier model tools from Anthropic, Google and OpenAI, including indirect prompt injection exfiltration. More reporting is under Cybersecurity.

What to watch next

GTIG expects discovery and exploitation to keep growing in the short to medium term. It urges a move from patching everything to threat-led triage, edge defence and automated, agent-driven remediation. Monthly figures for September onward are not yet published.

Questions people ask

How many vulnerabilities were disclosed in August 2026?

GTIG counted 10,740 in August 2026, up from 5,045 in January 2026. It warns that automated CVE assignment, for example for the Linux kernel, inflates the raw totals.

Are AI-discovered vulnerabilities more dangerous?

GTIG's data says they skew higher: 50% lead to remote code execution compared with 26% of all CVEs, and 58% rate Medium risk compared with 28%. GTIG links this partly to how research programmes aim their agents.

Which AI software has the most vulnerabilities?

Agent orchestration frameworks such as Flowise, Langflow and LangChain account for half of AI-related CVEs GTIG tracked, followed by AI web apps and inference servers.

Sources

1. Vulnerability Discovery and Exploitation Trends in the AI Era (Google Threat Intelligence Group, 30 Sep 2026)