Google Threat Intelligence Group reported that monthly software vulnerability disclosures doubled between January and August, rising from 5,045 to 10,740. While raw totals are inflated by automated identifiers in open-source projects, high-risk disclosures rose 167% to 350 in August.
Attackers exploited 141 newly disclosed vulnerabilities between January and August, surpassing the 127 recorded throughout 2025. Zero-day exploits averaged 11 per month this year, with 22 recorded in August alone. Most growth stems from n-day flaws, where attackers exploit public, patched vulnerabilities.
AI agents are increasingly used to discover flaws, with 58% of AI-identified bugs categorized as moderate risk. Half of these allow remote code execution, a rate significantly higher than the 26% observed in non-AI disclosures. Researchers often target critical infrastructure and memory corruption in C and C++ code.
The report highlights CVE-2026-1731 in BeyondTrust products, discovered by a Hacktron AI agent. Attackers exploited this flaw within four days, deploying malware and cryptocurrency miners. Since 2025, GTIG tracked 2,076 disclosures in AI software, with over 1,500 occurring this year.
Frameworks like Flowise and Langflow account for half of AI-related disclosures, while inference software like vLLM and Ollama saw 212. Google recommends that organizations prioritize patching based on threat intelligence rather than mass updates and suggests using AI code review tools.
