A Vulnerability Is Not an Exposure
A vulnerable condition may remain unchanged for years. An exposure changes with the environment and with the attacker’s capabilities.
2,300 Found, 421 Fixed
In November 2024 Google reported the first public case of an AI agent, Big Sleep, finding a previously unknown exploitable flaw in real software: a memory-safety bug in SQLite, reported in early October and fixed the same day, before it reached a release [1].
As of 26 August 2026, Anthropic reported 2,300 disclosed vulnerabilities in 392 open-source projects, all found since 1 November 2025. Of these, 421 had been fixed upstream, which is not the same as fixed in every installation [2]. The two programmes are not directly comparable, but the direction is plain enough. Automated discovery is becoming a mass process, but remediation is not.
Attackers have the same tool. In May 2026 Google Threat Intelligence Group described, for the first time, a zero-day which it...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
