AI Can Surface More Vulnerabilities Than Ever. Humans Still Have to Decide What Comes Next.

PUBLISHER ARTICLE PREVIEW

From the original article

For years, cybersecurity teams have operated under a simple assumption: if we could find more vulnerabilities faster, we would make software more secure.

Artificial intelligence is testing that assumption. As the broader AI conversation shifts from rapid adoption to measurable value, cybersecurity is exposing a challenge that won’t disappear with an AI slowdown. Organizations are already facing a growing volume of AI-generated vulnerability findings that still require human validation, prioritization, and remediation.

Recent findings from Project Glasswing offer one of the clearest examples yet. Claude Mythos Preview reportedly identified more than 26,000 vulnerability findings across software projects in just a few months. Yet according to an independent analysis of Glasswing’s public disclosure ledger, only about 10% of those findings have reached the disclosure process, and fewer than 1% have ultimately been patched.

Those numbers are striking, but they shouldn’t be surprising. The industry has spent decades optimizing for discovery. What it hasn’t built is the capacity to process vulnerability findings at AI scale.

The bottleneck in cybersecurity is no longer discovery. It’s what happens next.

In an early update from Project Glasswing, Anthropic noted that progress was increasingly constrained not by finding vulnerabilities, but by the human work required to verify reports, coordinate disclosures, and support remediation efforts. The company also noted that some maintainers requested slower disclosure rates because they lacked the capacity to process the volume of findings being generated.

This distinction matters because vulnerability discovery and vulnerability remediation are fundamentally different activities.

Discovery is increasingly a pattern-recognition problem. Modern AI systems excel at analyzing large codebases, identifying unusual behavior, tracing execution paths, and surfacing potential weaknesses.

Remediation is different. Fixing a vulnerability requires context.