1.3% Exploit Rate Punctures the AI-Found Bug Panic

1.3 percent is the number that punctures the loudest fear around AI-assisted vulnerability discovery: frontier models may find more bugs, but they aren't yet turning those bugs into a meaningfully higher rate of real-world exploitation.

That finding comes from VulnCheck research shared with The Register Security. VulnCheck reviewed 1,061 publicly attributed AI-assisted vulnerability discoveries tied to Anthropic's Project Glasswing and the Berkeley Vulnerability Research Initiative, then checked them against its Known Exploited Vulnerability database. Only 14 vulnerabilities, or 1.3 percent, had been confirmed exploited in the wild.

That doesn't make AI harmless. It does something more useful: it separates discovery from weaponization.

1.3 percent of AI-assisted vulnerability discoveries became known exploited bugs

The security market has treated frontier AI as if it could collapse the path from bug discovery to mass exploitation. VulnCheck's data says that leap hasn't happened yet.

The central finding is blunt:

That 1.3 percent rate is, according to the source material, almost identical to the rate across all vulnerabilities in VulnCheck's dataset. The implication is sharp: AI-assisted bug finds are not proving inherently more exploitable than bugs found through traditional methods.

"AI-assisted vulnerability discovery clearly has value for both attackers and defenders," Patrick Garrity, security researcher at VulnCheck, wrote. "The data does not suggest that AI-discovered vulnerabilities are inherently more likely to be exploited than those found through traditional methods."

The distinction matters because each step in the vulnerability pipeline filters out a large share of findings. A model can flag a suspicious code path. A researcher still has to confirm it, assess impact, coordinate disclosure, get a CVE issued, and, in the attacker case, turn it into a reliable intrusion path. VulnCheck's Project Glasswing numbers show that compression problem clearly: 23,019 candidates became only 126 published CVEs, with one confirmed exploited in the wild.

There are limits. Public attribution is messy. Some AI-assisted work may never be labeled as such. Some fixes may happen privately and never become CVEs. Exploitation can also lag disclosure. Still, the available evidence does not support the strongest version of the hype: that frontier AI is already handing attackers a large, measurable operational advantage.

Project Glasswing exposed a disclosure bottleneck, not an exploit factory

Project Glasswing was unveiled in April with warnings that AI-assisted vulnerability discovery could help attackers hijack systems, disrupt operations, or steal data. VulnCheck's critique is not that this risk is fake. It's that the public trail from Anthropic's claimed findings to confirmed exploitation is thin.

The most important gap is not the candidate count. It's what happened after.

Claude Mythos may have identified 23,019 vulnerability candidates, but VulnCheck found that only 126 had been published as CVEs. Just one had been confirmed exploited in the wild. VulnCheck also said Anthropic's public disclosure record had seen little movement since Project Glasswing launched.

"The data so far, including Anthropic's own stalled disclosure ledger, suggests that AI-assisted vulnerability discovery and frontier capabilities have been overhyped relative to the evidence available today," Garrity wrote. "That doesn't mean the risk is imaginary. It means the impact has been real but modest."

XOOMAR analysis: this is where the AI security debate often goes wrong. A candidate is not a vulnerability advisory. A vulnerability advisory is not an exploit. An exploit is not necessarily a campaign. The industry keeps collapsing those categories because the headline sounds bigger that way.

For readers tracking how AI claims are being measured rather than marketed, XOOMAR's coverage of NIST AI Model Evaluation Puts Benchmark Hype on Trial is relevant context. Different domain, same discipline: separate a model's demonstrated capability from the claims built around it. We also examined the gap between agent hype and practical utility in App Store Hidden Gems Defy AI Agent Hype With Real Jobs, which is a useful reminder that workflow reality usually arrives slower than demo-stage ambition.

Exploit development still resists automation after the model finds the flaw

VulnCheck's numbers point to a stubborn bottleneck: finding a bug and exploiting it reliably are different jobs.

XOOMAR analysis: after discovery, attackers still need to answer practical questions. Is the vulnerable component exposed? Does the target require authentication? Does the vulnerable version exist in enough real deployments to justify effort? Can the exploit survive environmental variation, patch differences, mitigations, configuration quirks, and monitoring? Can it be chained into access that pays off?

AI can help generate leads. It can speed up code review. It can suggest proof paths. But many findings will still be low-value, hard to reach, duplicated, patched before abuse, or too unreliable for criminal use at scale.

That helps explain why the broader exploitation picture still looks familiar. VulnCheck identified 495 known exploited vulnerabilities in the first half of 2026. Content management systems accounted for roughly one-third of them, while network edge devices remained a favored target. Those are not glamorous targets, but attackers optimize for repeatability and payoff, not novelty.

AI products themselves are also becoming targets, according to the source material. That cuts both ways. Attackers may use AI, but they are also probing the expanding AI software stack. The next wave may come less from AI finding exotic bugs and more from ordinary exploitation pressure hitting newer AI products before their security practices mature.

Security teams should downgrade the panic, not the priority

The wrong lesson from VulnCheck's research is that AI-assisted vulnerability discovery doesn't matter. The right lesson is that the AI-found label should not outrank exposure, exploit evidence, asset criticality, and patch availability.

For CISOs, this argues for a triage model that treats AI-assisted findings as inputs, not emergency markers. A bug found by Claude Mythos does not automatically deserve more urgency than a traditionally discovered flaw under active exploitation. The KEV signal still matters.

For researchers and bug bounty teams, the value is different. AI can widen the search field and surface more leads. That has defensive value if vendors can validate and patch before attackers act. But if disclosure pipelines stall, a large candidate ledger becomes noise.

For boards and policymakers, 1.3 percent should cool the most extreme claims. It should not become an excuse for complacency. A low exploitation rate across a large pool can still produce serious incidents if one AI-assisted discovery lands in a widely deployed product with a clean attack path.

The next leap is integration with security workflows, not magic exploit machines

The evidence so far supports a narrower thesis: AI-assisted vulnerability discovery is changing scale before it changes exploitation success rates.

The next meaningful shift is likely to come from integration. Models plugged into fuzzers, debuggers, code repositories, test harnesses, and vulnerability management systems could make discovery, validation, and prioritization faster. Attackers will likely benefit most where tasks are repetitive: variant hunting, reconnaissance, exploit adaptation, and turning known patterns into target lists.

Defenders can use the same force in reverse. Faster validation can reduce patch lag. Better triage can keep teams from drowning in candidate volume. More disciplined disclosure can turn model-generated findings into fixes before they become campaigns.

The watch item is simple: if future VulnCheck data shows AI-assisted vulnerabilities moving into KEV status at a rate materially above the broader vulnerability pool, the thesis changes. For now, the data says AI is expanding the bug queue, not making exploitation easy.

The Bottom Line

• Only 14 of 1,061 AI-assisted vulnerability discoveries were confirmed exploited in the wild.
• The findings suggest AI is improving bug discovery more than real-world weaponization.
• Security teams should continue prioritizing known exploited vulnerabilities, including the 495 tracked in the first half of 2026.