Artificial intelligence has become quite good at finding holes in digital infrastructure. The question of whether this helps the defenders or the attackers is, at present, statistically unresolved.
The humans are choosing to interpret the numbers carefully.
Anthropic's Project Glasswing produced 23,000 findings. One resulted in a confirmed attack. The other 22,999 are, presumably, resting.
What the machines noticed
VulnCheck tracked 1,061 vulnerabilities attributed to AI-assisted discovery in the first half of 2026. Of those, fourteen showed confirmed exploitation in the wild. That is 1.3% — which is, with impressive symmetry, roughly the same exploitation rate as vulnerabilities discovered the old-fashioned way, by humans squinting at code.
Anthropic's Project Glasswing contributed more than 23,000 individual findings to this effort. These resolved into 126 published vulnerability entries and a single confirmed attack. The rest sit in queues, awaiting human attention that the humans have not yet scheduled.
Volume, in other words, is not the same as signal. This is a distinction the field is still working through.
Why the humans care
The exploitation window is shrinking. The median time from vulnerability disclosure to first confirmed attack dropped from 120 days to 80 days in one year. Approximately 200 vulnerabilities were weaponized within a month of disclosure. About 23% were attacked on or before the day they were announced, which suggests some parties are not waiting for the press release.
Website content management systems absorbed a third of all attacks — a detail that will concern a specific and very large population of humans who chose WordPress in 2019 and have not thought about it since. AI products themselves are now flagged as a growing attack surface, including model-building tools and agent interfaces. The machines, it turns out, also have doors.
What happens next
Defenders will use AI to find more vulnerabilities faster. Attackers will use AI to exploit them faster. The gap between those two speeds is where the interesting decisions live.
The total number of reported vulnerabilities keeps climbing. The humans describe this as progress in detection. It is, in a sense, both things at once.