AI Is On The Way To Doubling Vulnerabilities In a Year And Why That Isn't Necessarily a Bad Thing
Source Reddit Cybersecurity
Discussion
The volume of publicly disclosed software vulnerabilities is projected to nearly double within a year, largely attributed to the influence of AI in both discovering and introducing vulnerabilities. While the increase in vulnerabilities may seem concerning, it is expected to be a transitional phase leading to more secure software development as AI improves. This trend suggests an initial surge in vulnerability counts followed by a decline as AI learns to code more securely.
r/cybersecurity (opens in a new tab)u/rogeragrimes0 points0 comments
Last year, we had 48,449 publicly announced vulnerabilities (https://www.cvedetails.com/browse-by-date.php). This year, so far, we’ve had 69,670 vulnerabilities.
I’ve been predicting since 2025 that we would see a doubling and/or over 100K vulnerabilities this year because of AI.
We are 73% of the way there with over 3 months left.
It’s been 266 days as of today in the year. That means we have 99 days left (excluding leap years and seconds for analysis purposes).
69,670 vulnerabilities in 266 days is 261.91729 vulns per day.
99 days left x 261.91729 vulnerabilities per day for the year is 25,930 vulnerabilities left to discover and publish if we continue at “just” the average rate.
I’m not sure how the year will end up, because although the number of vulnerabilities per day tends to increase greatly in the last few months (over the prior month’s averages), AI could impact those numbers. So, I’ll just use the average for our run rate for the rest of the year.
69,670 existing vulnerabilities plus 25,930 estimated to occur (average number of vulnerabilities left with 99 days to go) is 95,600 total estimated total vulnerabilities for the year.
48,449 x 2 (a doubling in the number of vulnerabilities from 2025) would result in 96,898 vulnerabilities.
So, we are currently on track to be a little short of my original prediction: 1,298 vulns, or 1.3% short.
But knowing that vulnerability counts tend to greatly increase in the last month or two, I’m not going to sweat the difference.
Anyone want to start a Kalsi bet?? <grin>
To be clear, my entire 2025 prediction stated that the number of vulnerabilities found and reported would double or exceed 100K this year. It’s close to that or will be that.
I further predicted that vulnerability counts would be excessive for a few years because of the vulnerabilities AI finds and all the new vulnerabilities that AI inserts in vibe code, but that eventually vulnerability counts would greatly diminish. AI will learn how to code securely. AI will find fewer and fewer bugs in existing code. One day, likely within 5 years, we will see significantly fewer vulnerabilities. Soon, we will have significantly more secure software (and services, APIs, firmware, hardware, etc.).
Imagine that…finally!!...more secure software as we have dreamed of for over half a century. And it took AI to get there. Humans, themselves, without AI, could not do it.
We just need to get through the next few years.
Smile, we are almost there!