AI Vulnerability Hunting Falls Short

The narrative surrounding artificial intelligence and cybersecurity has long been dominated by the fear that frontier models would provide attackers with a path to instant, high-impact exploits. However, recent analysis suggests a significant gap between the theoretical capabilities of these tools and the reality of threats surfacing in the wild.

The Gap Between Volume and Impact

Data provided by VulnCheck indicates that while AI is successfully scaling the identification of potential security flaws, these discoveries are rarely translating into active exploitation. By examining over 1,000 instances of AI-assisted research, the firm found that the percentage of these vulnerabilities actually used in attacks is statistically indistinguishable from those discovered via traditional manual processes.

Project Glasswing Under Scrutiny

Much of the recent industry discourse centered on Project Glasswing, an initiative that generated thousands of potential vulnerability candidates. Despite the initial warnings regarding the risks posed by such high-volume discovery, the downstream evidence of exploitation has remained sparse. Of the more than 23,000 candidates identified by the Claude Mythos model, only a small fraction have been formalized into public CVEs, with even fewer confirmed as exploited.

Market Metrics and Vulnerability Data

• Total AI-assisted discoveries analyzed: 1,061
• Confirmed exploited vulnerabilities: 14 (1.3 percent)
• Total vulnerability candidates generated by Claude Mythos: 23,019
• Number of known exploited vulnerabilities identified in first half of 2026: 495

The data so far, including Anthropic's own stalled disclosure ledger, suggests that AI-assisted vulnerability discovery and frontier capabilities have been overhyped relative to the evidence available today. That doesn't mean the risk is imaginary. It means the impact has been real but modest.

— Patrick Garrity, security researcher at VulnCheck

The Evolving Threat Landscape

While the predicted exploitation apocalypse driven by AI has yet to materialize, researchers emphasize that the broader threat environment remains active. Attackers continue to focus on traditional targets such as network edge devices and content management systems, while simultaneously pivoting toward the AI software stack itself as an emerging attack surface. The shifting focus suggests that while AI tools are not yet the force multiplier for exploitation that many feared, they are undeniably changing the mechanics of vulnerability research for both offensive and defensive parties alike.

Implications for Security Strategy

For security teams, these findings suggest that the influx of AI-generated vulnerability data may create a noise management challenge rather than an immediate, critical spike in external threats. As AI continues to inflate the volume of reported flaws, the ability to prioritize and patch based on actual exploitation intelligence—rather than speculative risk—could become the primary differentiator between successful defense and operational fatigue.