The Exploitable Gap

AI is making vulnerabilities easier to find and faster to weaponize. The harder problem is giving defenders the context, confidence, and control to respond at the same speed.

Vulnerability Discovery Becomes Abundant

AI is making vulnerability discovery dramatically cheaper and faster. Mozilla offers a clear example: in April 2026, Firefox fixed 423 security bugs, compared with roughly 20–30 in a typical month during 2025. At least 271 of those bugs were found during an evaluation of Anthropic’s Claude Mythos Preview, including 180 rated sec-high.

The Linux kernel tells a blunter version of the story. An NVD-derived dataset contains 195 Critical-rated kernel CVEs published in the first seven months of 2026, nearly three quarters of all records carrying that rating in the dataset. Historical comparisons are imperfect because CVE-assignment practices and CVSS versions have changed, but the concentration is still striking.

Zoom out and the pattern holds industry-wide.

The broader ecosystem is moving in the same direction. NIST has stopped trying to enrich every CVE equally. Lower-priority records may remain without additional NIST analysis, leaving defenders more dependent on uneven CNA data and vendor advisories for severity, weakness classification, and affected-product mapping.

FIRST raised its 2026 CVE forecast from approximately 59,000 to 66,000, after disclosures during the first four months ran 46.3% ahead of its original projected path. FIRST explicitly identifies AI-assisted discovery as one of the forces driving the increase.

More CVEs do not necessarily mean proportionally more dangerous vulnerabilities. But they do create more noise around the dangerous ones, increasing the cost of enrichment, validation, prioritization, and asset correlation.

The shift is simple: vulnerabilities are becoming abundant, while the capacity to validate, prioritize, and remediate them remains scarce.

The Window Collapses

The same capabilities that make weaknesses easier to find make them faster to weaponize.

Rapid7's March 2026 Global Threat Landscape Report recorded exploited high- and critical-severity vulnerabilities more than doubling year over year - 71 in 2024 to 146 in 2025 - while the median time from CVE publication to CISA's Known Exploited Vulnerabilities listing fell from 8.5 days to 5.0. Mandiant's 2025 data put mean time-to-exploit at negative seven days, meaning exploitation began, on average, seven days before a patch was released. CrowdStrike separately reported a 42% year-over-year increase in zero-days exploited before public disclosure. Google Cloud's Threat Horizons report for H1 2026 puts a shape on the trend: the gap between disclosure and active exploitation collapsed from weeks to days across the second half of 2025.

I watched what that collapse feels like from a single desk. A researcher posted a short, detail-light disclosure, describing a remote-code-execution bug in Fastjson 1.2.83 - a few claims, no proof of concept, no payload. I gave that public fragment to an AI agent in an isolated lab. Within a couple of hours I had a working exploit.

That is one experiment, not a benchmark, and it does not prove that every vulnerability can be weaponized on demand. What it shows is how little public information an agent now needs to begin an autonomous cycle of hypothesis, testing, failure, and adaptation. Bespoke, target-specific attacks that were once too expensive outside high-value targets are becoming cheap enough to run by default.

Risk-Based Response: CISA’s BOD 26-04

CISA’s Binding Operational Directive 26-04 is an important move in the right direction. It recognizes that vulnerability response cannot be driven by severity scores alone. The directive prioritizes remediation using four factors: whether the affected asset is publicly exposed, whether the vulnerability appears in CISA’s Known Exploited Vulnerabilities catalog, whether exploitation can be automated, and whether successful exploitation gives an attacker partial or total control. The highest-risk combinations carry deadlines as short as three calendar days, with forensic triage required in some cases.

Three days is not really a patching deadline. It's a maturity test. No organization can meet it reliably without an accurate asset inventory, clear ownership, rapid exploitability validation, controls that can reduce exposure immediately, tested emergency deployment paths, safe rollback, and monitoring to confirm that the fix worked. BOD 26-04 makes those capabilities operationally unavoidable. That is exactly the forcing function this moment needs.

Before the Vulnerability Has a Name

BOD 26-04 begins once a vulnerability has been identified, assigned a CVE, and mapped to an affected asset. AI-native attacks do not need to wait that long. In the Hugging Face incident, agents discovered and chained previously unknown weaknesses in first-party code and configuration-before there was an advisory, a KEV entry, or a remediation clock. The same blind spot covers authorization flaws, unsafe API behavior, excessive permissions, and misconfigurations unique to one organization. Many will never enter a CVE feed at all. The broader lesson is to apply the same risk logic upstream: continuously test first-party systems for exploitable paths. When immediate remediation is impossible, defenders need compensating controls that reduce reachability, privilege, or exploitability until a permanent fix can be safely deployed.

Closing the Exploitable Gap

The Hugging Face incident contains the transition in one story. The weakness classes were familiar: unsafe first-party functionality, configuration problems and insufficient containment. The attacker was different. It could discover, combine, adapt, and continue without waiting for a human operator.

Offense can tolerate thousands of failed actions and needs only one exploitable path. Defense cannot. Defensive action must be fast, but it must also be accurate, bounded, auditable, and reversible. That higher bar-not a lack of model capability-is why AI-native defense is arriving more slowly. The answer is not simply to build an offensive agent pointed in the other direction. It is to change the timeline. Find exploitable paths before attackers do. Build the maturity to contain and remediate them quickly. Put controls in place that can reduce exposure immediately, buying teams time to investigate and fix the underlying problem.The asymmetry cannot be eliminated. But defenders can buy enough time to stop it from deciding the outcome.

For Radware customers, these capabilities already exist across different parts of the security stack:

• Proactive API testing can expose first-party attack paths
• Posture management can help identify and prioritize affected assets
• Bot management and application-security controls can reduce exposure to automated and malicious traffic

The opportunity now is to connect those capabilities into a faster operating loop.

Sources