AI Bug Hunters Have Logged 45,207 CVEs in Seven Months, Nearly All of 2025's Record. The Exploit Wave That Should Follow Isn't Showing Up.

TL;DR

The US National Vulnerability Database logged 45,207 security flaws between January 1 and July 27, according to Bloomberg's review of the data: nearly the whole of 2025's all-time record, with five months of the year still to go. July alone set vendor records across the board. Oracle shipped 1,449 patches in one quarterly update, Microsoft disclosed 642 bugs for the month, and a single Chrome release fixed 433. Everyone points at the same cause: AI systems now find flaws at machine scale, and vendors are running the same tools on their own code. Meanwhile, Recorded Future says the average time from disclosure to working exploit fell from 72 hours to 24. The twist worth keeping: the US government's Known Exploited Vulnerabilities catalog shows no corresponding rise in real-world exploitation. The finding exploded; the doom, so far, did not.

Seven months to burn through a record year

The raw count is the headline. 45,207 CVEs recorded by the NVD through July 27, per Bloomberg, nearly matching the full-year 2025 total that was itself an all-time record. Bloomberg puts 2026 on pace to roughly double 2025's tally.

Even the professionals keep revising upward. In mid-June, FIRST, the incident-response body that runs the CVE forecast, raised its 2026 projection to roughly 66,000 CVEs, already well above its own start-of-year estimate. Do the arithmetic on Bloomberg's July 27 number and the run rate annualizes to nearly 80,000. The forecast that looked aggressive six weeks ago now looks conservative.

FIRST named the driver plainly: autonomous AI discovery agents, citing systems like Anthropic's Mythos and OpenAI's GPT-5.4-Cyber, plus programs like Project Glasswing, which surfaced fixes for 271 bugs in a single Firefox release. Gabriel Bernadett-Shapiro of SentinelOne put it to Bloomberg without hedging: "We have to come to the reckoning that these tools are increasing the ability of people to find vulnerabilities in software."

July was one long patch note

Oracle's July Critical Patch Update contains 1,449 security patches, the largest in the company's history and up from 309 in July 2025. Qualys counts 1,235 unique CVEs across 32 product families, and about 86% of the patches cover non-Oracle CVEs: open-source components bundled inside Oracle products. Oracle's own announcement credits, among other factors, "AI-powered identification of actionable security findings." The quarterly advisory used to be a document; the July edition is closer to a census.

Microsoft disclosed 642 bugs across July by Bloomberg's tally, versus roughly 128 in July 2025. That lands two weeks after a Patch Tuesday that already set a record at 570, where Microsoft said its own AI tooling drove the surge.

Chrome is the starkest case. Chrome 150 fixed 433 vulnerabilities in one release, 20 of them critical, against 11 in the comparable release a year earlier. Per Bloomberg, 401 of the 433 were reported internally by Google's own teams, found with AI-assisted tooling layered on the classic fuzzing stack (LibFuzzer, AFL, sanitizers). Google's Doug Turner attributed the "unprecedented scale and speed" of discovery to AI and the investment behind it. Google also paid $319,000 in bounties for the release, including $250,000 for a single critical ANGLE bug, so the humans in the loop are still eating well.

The 24-hour window

Discovery is not the only thing that sped up. Alexander Leslie at Recorded Future told Bloomberg that the average time from a vulnerability's disclosure to a working exploit dropped from 72 hours last year to 24 hours in 2026. Attackers have the same class of tools the defenders do, and turning an advisory into an exploit is exactly the kind of bounded, verifiable task current models are good at.

For anyone running internet-facing services, that number matters more than the CVE count. A patch cadence of "this weekend" was defensible against a 72-hour window. Against 24 hours it is a coin flip.

The doom that isn't in the data

Here is the part the scary chart leaves out. Despite the doubled discovery rate, the government's Known Exploited Vulnerabilities catalog, which tracks flaws confirmed to be under real-world attack, shows no corresponding rise. Dustin Childs of Trend Micro's Zero Day Initiative told Bloomberg he is "not seeing the numbers to back up the doom and gloom."

The mechanism is worth being precise about. AI scaled the finding of flaws, but exploitation at scale still requires a target worth hitting, a reachable attack surface, and an economic reason to bother. Most of the new CVEs are in code paths attackers never cared about. Think of a city that installs a thousand new speed cameras: tickets explode overnight, but the number of actual crashes barely moves, because the cameras measure detection, not danger. The CVE count is now mostly a measure of how hard we are looking.

There is a genuinely good reading of the same numbers. When 401 of Chrome's 433 flaws are found by Google before anyone else, that is the defense winning the race to the bug. FIRST's Chris Gibson frames the survival strategy as coordination rather than panic: the teams that weather 2026 are "the ones with trusted networks already in place, who are sharing intelligence and are coordinating response before any crises hit."

What this means for your stack

First, stop triaging by raw CVE count; that signal is now dominated by discovery capacity, not risk. Filter by the KEV catalog and exploit-likelihood scoring like EPSS, and treat everything else as scheduled maintenance.

Second, the 24-hour exploit window makes unattended patching the default posture for anything internet-facing, homelab included. If a human has to read the advisory before the fix rolls, you are structurally behind.

Third, Oracle's 86% figure is the quiet lesson: the flood is overwhelmingly in bundled open-source components, not vendors' own code. Knowing what is actually inside your images and dependencies is no longer compliance theater; it is how you tell which 20 of this month's 1,400 patches apply to you.

Key Takeaways

• The NVD logged 45,207 CVEs from January 1 to July 27, per Bloomberg: nearly all of 2025's record total, with 2026 on pace to roughly double it.
• July set vendor records everywhere: Oracle patched 1,449 flaws in one update (309 a year ago), Microsoft disclosed 642 for the month, and Chrome 150 fixed 433 in a single release (11 a year ago).
• Vendors and FIRST attribute the surge to AI-powered discovery, and FIRST's revised ~66,000 forecast for 2026 already trails the actual run rate.
• Average time from disclosure to working exploit fell from 72 hours to 24, per Recorded Future, which matters more to defenders than the raw count.
• The KEV catalog shows no matching rise in actual exploitation: discovery scaled, attacks did not, at least so far.
• Practical response: triage by KEV and EPSS rather than CVE volume, automate patching on anything internet-facing, and know your dependency tree, because the flood is mostly in bundled open source.

Sources: Bloomberg, The Star (Bloomberg syndication), Forbes, Qualys, Oracle Security Blog, Help Net Security, Winaero