AI-Hunting Explodes Bug Count Past 100,000

The total number of reported software vulnerabilities, known as CVEs, has blasted past 100,000 in 2026, more than doubling last year's count. Security experts point squarely at AI-powered bug-hunting tools as the main driver, with major tech vendors like Microsoft adding thousands of new flaws to the list each month. This surge has fundamentally changed the risk landscape.

While the percentage of bugs that get actively exploited remains small at about 1.4%, the raw number of dangerous vulnerabilities is now massive. More critically, the time between a bug being publicly disclosed and attackers weaponizing it is collapsing, often to mere hours, as AI also helps attackers reverse-engineer patches. The takeaway is that AI has turbocharged both the discovery of problems and the speed of attacks, creating a relentless new pressure on security teams.