Google’s Threat Intelligence Group (GTIG) published an analysis of vulnerabilities from January 2025 to August 2026 with an uncomfortable finding: flaws attributed to AI discovery are, on average, more severe, and attackers are exploiting them faster.
According to Help Net Security, SecurityWeek, and Infosecurity Magazine’s coverage of the GTIG report, monthly CVE disclosures rose from 5,045 to 10,740 in August 2026. Even so, only 0.23% of disclosed vulnerabilities end up exploited in practice: the problem isn’t volume, it’s which ones matter.
GTIG attributes the gap to the kinds of bugs models are good at spotting: memory corruption and logic flaws, precisely the ones traditional static analyzers tend to miss. Those are also the bugs most likely to end in remote code execution (RCE), which is what an attacker wants.
Another factor is speed after disclosure. The case cited is CVE-2026-1731, a BeyondTrust flaw discovered by an AI agent from Hacktron: GTIG saw one threat group exploiting it four days after disclosure, and five more groups joined within a week. According to the report, much of the growth in exploitation comes from n-days, meaning already-patched flaws that attackers take advantage of by using LLMs to analyze patches and turn them into exploits.
A detail that matters to anyone building agents: according to GTIG data reported by Help Net Security, orchestration tools like Flowise and Langflow account for half of the 2026 AI software vulnerability disclosures, and attackers exploit their code-execution nodes through prompt injection. In other words, the agent stack itself is now a priority attack surface, not just a consumer of vulnerable software.
GTIG recommends moving from blanket patching without prioritization to threat-intelligence-guided triage, combining edge defense with automated agentic remediation. In practice: (1) inventory where Flowise, Langflow, or similar tools run, and don’t expose them to the internet without authentication; (2) prioritize patches for externally reachable systems with RCE risk; (3) treat the code nodes in your agent workflows as arbitrary execution, with isolation and least privilege; (4) measure the time from disclosure to patch, because today it’s measured in days.
A note on method: the “discovered by AI” attribution in the report is a probable label, not a certainty for every CVE, so the 50% vs. 26% figure is best read as a trend rather than an exact measurement.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel