AI Is Now Finding Software Bugs Faster Than We Can Patch Them — 2026 Is on Track for 66,000 CVEs

Here is the number that stopped me this week: about 66,000.

That is how many software vulnerabilities — CVEs — the Forum of Incident Response and Security Teams (FIRST) now expects the world to disclose in 2026. They raised their mid-year forecast up from a February median of roughly 59,400, and they were blunt about the driver (FIRST). AI tools have started hunting for software flaws on their own, and they are good at it (Help Net Security).

Read that again. Not "AI helps a researcher go faster." AI agents finding bugs without a human prompting them. FIRST even named names — Anthropic’s Mythos and OpenAI’s GPT-5.4-Cyber are among the key drivers behind the surge (Help Net Security).

I run IT infrastructure and operations for a living, so a forecast like this lands on my desk as work, not as a headline. Let me unpack what is actually happening, because the scary number hides a more useful story.

What the forecast actually says

FIRST is careful to point out that this surge does not mean software suddenly got worse. It reflects more aggressive research and better reporting, not a collapse in code quality (Help Net Security). They flag three structural drivers: AI-assisted vulnerability discovery, a 449% year-over-year jump in GitHub Security Advisory volume, and a 3,119% increase in VulnCheck "CNA-of-last-resort" activity (Help Net Security).

Here is the part that matters most to anyone who has to respond to this. When you filter down to vulnerabilities that are actually being exploited in the wild, the patching burden stays roughly flat (Help Net Security). Only a thin slice of those 66,000 reach the point where defenders have to drop everything. So the headline number is enormous, and the genuinely urgent number is not.

That gap is the whole game. FIRST’s own framing is that analyst capacity is now the binding constraint — teams cannot verify and patch faster than AI discovers flaws (FIRST). If you do not scale how you triage, you end up with a backlog of confirmed flaws sitting unpatched for months.

The other half: agents are an attack surface too

The same week’s reporting is a good reminder that AI does not just find bugs — it introduces them. Microsoft’s security team disclosed two critical vulnerabilities in its Semantic Kernel agent framework that could turn a prompt injection into host-level remote code execution, where a single crafted prompt is enough to launch applications on the machine running the agent (Microsoft Security). And the mood in the field matches the math: Darktrace’s 2026 survey found 92% of security professionals are concerned about the impact of AI agents (Darktrace).

I have written before about how Claude Cowork makes its safety gates visible — it refuses to log into things for me and asks before sensitive actions. That kind of explicit friction looks slow until you read a disclosure like the Semantic Kernel one. Then it looks like the point.

What this means if you run a small business

You are not going to staff a vulnerability-management team. You do not have to. The takeaway for an independent operator is narrower and more doable.

Patch the boring stuff automatically. Turn on auto-updates for your operating system, your browser, your WordPress plugins, your phone. Most of what gets exploited is old, known, and already fixed by someone who is waiting for you to install it. The 66,000 forecast does not change your job here; it just makes "I’ll update later" a worse bet than it already was.

And if you are wiring AI agents into your tools — connecting an automation platform to your email, your CRM, your site — treat every connector as a door. Ask what it can do if someone feeds it a poisoned input. Prefer tools that ask permission over tools that assume it.

What this means if you lead enterprise IT

Your problem is triage, not volume. The number that matters in your shop is not 66,000; it is how many of those map to software you actually run, exposed in ways that actually matter. Invest in the layer that filters signal from noise — exploit-prediction scoring, asset inventory, reachability analysis — because FIRST is telling you plainly that human analyst hours are now your bottleneck (FIRST).

This is also the year to put a written policy around agent frameworks before your developers ship them. The Semantic Kernel disclosure is a template for the next twelve months of headlines (Microsoft Security). If an agent in your stack can execute code or reach a private system, it needs a sandbox and a least-privilege boundary, full stop.

My take

The 66,000 number is going to get used to sell fear, and I want to push back on that. The honest read is more interesting. AI is now a tireless, cheap security researcher working for both sides at once. On defense, that is genuinely good news over time — flaws that used to hide for years get surfaced and fixed. On offense, the attackers got the same tireless researcher.

The deciding factor is not the AI. It is whether your organization can keep up with verification and patching once discovery becomes nearly free. The tools that find the bugs are not the bottleneck anymore. People are. Spend accordingly — on the humans and the triage tooling that turn a scary forecast into a manageable Tuesday.

News commentary by Brad Rowland — IT Infrastructure and Operations leader, automation builder, and AI implementer. Sources are linked inline.