Despite concerns that advanced artificial intelligence models would lead to widespread cyberattacks, data shows that hackers rarely exploit vulnerabilities discovered by AI. Research by Patrick Garrity from VulnCheck indicates that less than 0.5% of security flaws identified by Anthropic's Glasswing project have been utilized in real-world attacks.
Garrity tracked 225 vulnerabilities officially registered under the Glasswing initiative since its launch in April. As of September 21, 2026, only one of these, a critical SQL injection flaw in the Ghost platform (CVE-2026-26980), has been exploited by malicious actors.
The study suggests that AI-discovered vulnerabilities do not pose a greater threat than those found through other means. While AI has lowered the barrier to entry for vulnerability detection, it remains less effective at remediation. Research from 1Password's Off-by-1 lab shows that OpenAI GPT-5.5 and Anthropic Opus 4.8 models successfully fixed vulnerabilities in only 26% of cases.
In 54% of instances, these AI models failed to resolve the issue, introduced new vulnerabilities, or both. Experts emphasize that critical stages such as coordination, prioritization, and the deployment of patches still require significant human intervention, a challenge that remains a bottleneck in the security lifecycle.
