Welcome to the Vulnpocalypse: AI Security Tools Uncover Record-Breaking Number of Vulnerabilities

The vulnpocalypse has arrived. Security vendors are now using advanced AI models to scan their codebases, resulting in a dramatic increase in discovered vulnerabilities that's creating significant challenges for organizations worldwide.

Palo Alto Networks, which typically identifies five vulnerabilities monthly, recently announced it discovered 75 security holes using AI tools like Anthropic's Mythos, Claude Opus 4.7, and OpenAI's GPT-5.5-Cyber. These findings were documented across 26 CVEs (Common Vulnerabilities and Exposures), affecting over 130 of the company's products and platforms.

"Today, we released our May 'Patch Wednesday' security advisories," said Lee Klarich, product manager at Palo Alto Networks. "This is the first time where the majority of findings were the result of frontier AI models scanning our code."

This surge comes on the heels of Microsoft's record-breaking Patch Tuesday, where the company disclosed 30 critical CVEs. Microsoft attributed 17 of these findings to its new multi-model agentic scanning harness (MDASH), which orchestrates more than 100 specialized AI agents across various models to discover security flaws.

"Unlike single-model approaches, the harness orchestrates more than 100 specialized AI agents across an ensemble of frontier and distilled models to discover, debate, and prove exploitable bugs end-to-end," explained Microsoft VP of agentic security Taesoo Kim.

Mozilla has also experienced a dramatic increase in bug discoveries, reporting 423 Firefox bugs fixed in April—more than five times the 76 fixes issued in March and nearly 20 times higher than its 21.5 monthly average last year. The browser maker previously noted that Mythos found 271 flaws in Firefox 150.

The Regulatory and Compliance Implications

The surge in discovered vulnerabilities has significant implications for data protection and regulatory compliance. Under frameworks like GDPR and CCPA, organizations have strict obligations to protect personal data and report breaches promptly. The sudden increase in vulnerabilities creates new compliance challenges:

1. Reporting Requirements: Organizations must now report vulnerabilities more frequently to regulatory bodies and affected users
2. Remediation Deadlines: Regulations often require fixes within specific timeframes, creating pressure on security teams
3. Third-party Risk: Organizations using products from vendors experiencing the vulnpocalypse must assess their increased risk exposure

"We intend to fix every vulnerability we find before advanced AI capabilities become widely available to adversaries," Klarich stated, noting a "narrow three-to-five-month window for organizations to outpace the adversary before AI-driven exploits start to become the new norm."

The Vulnerability Management Bottleneck

While AI has dramatically improved the ability to find vulnerabilities, it hasn't addressed the fundamental bottleneck in vulnerability management: the process of triage, disclosure, patching, and deployment.

"Finding bugs has always been the cheap end of the pipeline," explained Katie Moussouris, CEO of Luta and a veteran of Microsoft's security response team. "Triage, disclosure, building patches that do not break production, and getting customers to deploy them is the expensive end, and nobody has funded it for this volume."

This creates a significant challenge for IT administrators who must now process and deploy patches at unprecedented rates. Tom Gallagher, VP of engineering at Microsoft Security Response Center, acknowledged that "this month's release sits on the larger side of a hotpatch month" and expects AI-assisted bug hunting to continue increasing Patch Tuesday volumes.

Trust Issues with AI-Generated Patches

Another emerging concern is the potential lack of trust in AI-generated patches. Dustin Childs, chief vulnerability researcher at Zero Day Initiative, warns that "many customers don't trust patches as it is, so if AI-related patches break things, they are less likely to apply as time goes on. This will be true even if AI only finds the bugs and doesn't make the patches."

The challenge is particularly acute for organizations that have already experienced issues with automated security updates that disrupted production systems.

The Multi-Model Approach

Both Microsoft and Palo Alto Networks have discovered that no single AI model catches all vulnerabilities. This has led them to adopt multi-model approaches:

• Palo Alto Networks uses Mythos, Claude Opus 4.7, and GPT-5.5-Cyber because "each finds bugs the others miss"
• Microsoft orchestrates over 100 specialized agents across multiple models
• According to Moussouris, when Microsoft adds threat intelligence and codebase context, its system can rediscover 96% of five years of confirmed bugs in critical Windows components

The Race Against Time

Security experts agree that organizations have a limited window to address vulnerabilities before adversaries catch up with similar AI capabilities.

"The asymmetry is temporary," Moussouris warned. "PAN puts adversary parity at three to five months, so any vendor not scanning their own code now is letting someone else find their bugs first."

This creates an urgent imperative for organizations to:

1. Implement AI-assisted vulnerability scanning in their development processes
2. Invest in automated deployment systems for patches
3. Improve vulnerability prioritization frameworks
4. Enhance third-party risk management programs

Looking Forward

The vulnpocalypse represents both a challenge and an opportunity. While the immediate increase in vulnerabilities creates operational headaches, it also allows organizations to address potential security issues before they're exploited in the wild.

"All vendors should use what tools they have to find and remediate bugs before they are exploited in the wild," Childs emphasized. "Ideally, they would find the bugs before they even ship, but I'm not holding my breath for that to happen."

As AI continues to evolve, we can expect vulnerability discovery rates to remain elevated. Organizations that build robust processes for managing this volume of patches will emerge more secure, while those that struggle with the transition may face increased exposure to cyber threats.

For more information on the AI tools mentioned in this article:

• Anthropic's Project Glasswing
• Microsoft's MDASH system
• Palo Alto Networks' Patch Wednesday advisories