Flaws found by AI are more often dangerous, Google says
On 30 September Google reported that half of the flaws AI finds let an attacker run their own code remotely. The number of reported flaws per month also doubled this year.
What happened
AI is changing not only how fast flaws in software are found, but also what kind of flaws. That is the conclusion of the Google Threat Intelligence Group in a report published on 30 September: half of the flaws AI finds let an attacker run their own code remotely, against 26% of other flaws.
The number of reported flaws grew sharply. Every known flaw gets a public number, a CVE, and 5,045 of them appeared in January and 10,477 in July; in August there were 10,740. Exploitation rose too. Between January and August Google saw 141 flaws that attackers actually used, more than the 127 in the whole of 2025: 18 a month on average, against 10.5 last year. Zero-days, flaws that are exploited before a fix exists, rose less steeply, from 8 to 11 a month, but August saw 22.
According to Google, AI models are especially good at finding memory errors and flaws in logic that ordinary scanners miss. Of the flaws AI found, Google rated 58% as medium risk, against 28% for the rest. The report also gives an example of such a flaw being exploited. A research agent from the company Hacktron AI independently found a flaw in BeyondTrust’s remote support software that let anyone run commands without logging in. Within four days of disclosure a first group of attackers was using it, and five more followed within a week. They raised their privileges, took data out and installed malicious software, including programs that mine cryptocurrency at the victim’s expense.
Google itself says the figures should be read with care. It calls attackers exploiting AI-found flaws an early signal rather than an established trend. But Google does expect the discovery and exploitation of flaws to keep rising in the short to medium term.
Have AI review your code and fix the flaws before that code goes live.
Google’s advice to companies that supply software, in short
The background
How AI finds flaws
In November 2024 Google reported that its AI agent Big Sleep had found an unknown, exploitable flaw in SQLite, a widely used database. Google believed it was the first public example of an AI agent finding such a flaw in software that runs everywhere. Security companies now deploy agents that read through code, try it out and check their own findings. Google also has CodeMender, which not only finds a flaw but proposes a fix, and recommends it to software makers.
They excel at memory errors: a program writing past the end of a block of memory, or using memory that has already been released. Errors like these often let an attacker run their own code, which according to Google explains the 50%. Researchers also deliberately aim their agents at critical systems, which pushes up the risk of what they find.
Why the number of flaws misleads
Not every number is a danger. The organisations allowed to issue CVEs each do so in their own way. The team behind the Linux kernel, the heart of Linux, deliberately gives almost every fix a number, because at the core of a system almost any bug could be exploited. Around 5,000 CVEs came from there up to August this year, without a single one exploited as a zero-day.
Of all the flaws reported this year, Google saw only 0.23% actually exploited: about one in 431. Attackers mostly strike where systems can be reached from outside: 14% of exploited flaws were in devices at the edge of the network, such as firewalls. And the software around AI is itself a growing target: since January 2025 Google has counted 2,076 flaws in AI-related software, half of them in the orchestration software that connects AI models to other systems.
Our analysis
The number of flaws isn’t the problem; the speed afterwards is
The doubling makes the headlines, but it says less than it seems: much of it comes from one project’s bookkeeping, and almost none of those flaws are actually exploited. The most important part comes later in the report. According to Google, the growth in exploitation comes mainly from flaws that already have a fix. Attackers are probably using AI to compare an update with the old version, see what was repaired and quickly build an attack on it. That makes every update a manual for attackers too.
The BeyondTrust case shows how that plays out: a researchers’ agent found the flaw, and within a week six groups of attackers were using it. Our expectation: the time between an update and the first attack is getting shorter, and leaving an update for weeks carries more risk than it used to. That seems to clash with the advice to leave new versions of packages for a few days, but it is about something else. New features can wait; a security update for a system that faces the internet cannot.
The practical lesson: know which systems can be reached from outside and fix those first. Look at what attackers actually use, not at the length of the list. And count the tools your colleagues build with AI: they often run on AI orchestration software, in which 782 flaws have been reported this year alone.
What stands out
- One in 431 Of the flaws reported this year, Google saw 0.23% actually exploited. Knowing which ones matter helps more than a long list.
- The real number is higher Public databases don’t record whether AI found a flaw, and large cloud companies often fix such flaws without a number. What Google counts is a minimum.
- Software around AI is a target itself Orchestration software that connects AI models to other systems accounts for half of the flaws in AI-related software. That number grew by 347% this year.
- Attackers write with it too In May Google reported the first known attacker with zero-day attack code made with AI. It was intercepted while the attack was still being planned.
What it means for you
More flaws, and more dangerous ones, mean that every tool you use or build needs updating more often and more quickly.
- Attackers move fast For one flaw, Google saw the first attackers within four days of it being made public. An update left for weeks is an open door.
- Home-built tools count too A tool a colleague built with AI also relies on components made by others. When one of them has a flaw, that tool needs updating as well.
- Know what is running You can only update what you know about. Keep track of which tools and components you use, and who looks after them.
Where we come in · Support
We keep track of the flaws in your own tools
With Support our portal continuously scans the code your colleagues build with AI for flaws, keys in the code and vulnerable libraries. A senior developer reviews the signals and discusses with you what needs to happen.
Do you know who keeps your colleagues’ tools up to date?
Tell us what your colleagues are building. We’ll look at it with you and always reply within one working day.
