Don't Judge an AI-Discovered CVE by Its Category
Aviral Verma
Securin Team
July 29, 2026
Memory corruption bugs are 6x rarer in weaponized exploits than in what AI is finding, and the AI-discovered ones are moving to exploitation faster anyway.
If AI changes what gets found, it can change what gets weaponized next. That should change how defenders read risk.
TL;DR
We compared 186 AI-discovered CVEs with 1,654 weaponized 2026 CVEs and the full 2026 baseline of 40,323 CVEs to answer one question:
Is AI simply accelerating vulnerability discovery, or is it changing what gets found?
The answer isn't a clean either/or. The data points to a shift in what AI is surfacing, and a warning about how defenders could misread that shift.
Three things jump out:
1.AI-discovered CVEs are not “humans but faster.”
If AI were simply accelerating what human researchers already find, the results would look broadly similar to the wider 2026 CVE baseline or to CVEs already being weaponized. They don’t. The CWE family distribution points to a different vulnerability profile.
2.AI-discovered CVEs are heavily concentrated in memory corruption and type-safety classes. Memory corruption accounts for 50.1% of AI-discovered CWE attributions, compared with 9.8% of the weaponized 2026 set and 18.4% of the full 2026 baseline. Injection moves in the opposite direction: 31.0% of the weaponized set and 23.0% of the baseline, but only 4.2% of the AI-discovered set. AI-discovered CVEs still include injection-class weaknesses (primarily XSS, code injection and OS command injection), but they are proportionally rare compared with memory-safety weaknesses.
3.AI-discovered CVEs are already showing stronger exploit signals.
AI-discovered CVEs are 5x more likely to have a public exploit and 4.2x more likely to appear in Securin KEV than the 2026 baseline. In the data we examined, 15.6% of AI-discovered CVEs (29 of 185) had a public exploit, compared with 4.10% across all 2026 CVEs (1,654 of 40,323). The exploited-in-the-wild signal is sharper: four of the 185 AI-discovered CVEs are in Securin KEV, or 2.16%. Across the 2026 baseline, 208 of 40,323 CVEs are in Securin KEV, or 0.52%.
Bottom line: This creates a prioritization trap. AI-discovered CVEs may not look like yesterday’s most familiar exploitation patterns, but the individual CVEs in this cohort are already showing disproportionately strong exploit signals.
The story starts with the shape of the queue.
The shape of the queue is changing
Project Glasswing has sharpened the AI vulnerability debate. Speed and scale have been the headline claims, but the deeper question is whether AI is simply accelerating a familiar discovery pipeline or making a different part of the vulnerability landscape visible. The answer matters for security teams because the data points to a shift in both discovery and risk.
So we tested the shape of the queue.
We compared publicly attributed AI-discovered CVEs against two reference points: CVEs published in 2026 with known public exploits, and the full 2026 CVE baseline.
These results describe more than speed and volume. AI-discovered CVEs aren't clustering where today’s weaponized CVEs usually cluster. They’re concentrated in deeper code-level weaknesses: memory corruption, type safety, undefined behavior and cryptographic verification.
The contrast is marked. Memory corruption accounts for 57.7% of AI-discovered CWE attributions, compared with 9.5% of the weaponized 2026 set and 19.0% of the full 2026 baseline. Injection moves in the opposite direction, accounting for 24.3% of the weaponized set and 20.1% of the baseline, but only 3.8% of the AI-discovered set.
This pattern matters because prioritization models often lean on historical exploitation patterns. If teams only look for the vulnerability classes attackers have most often weaponized before, they may miss the AI-discovered CVEs moving fastest now.
The prioritization trap
This is where the data gets easy to misread. Look only at vulnerability categories, and AI-discovered CVEs can appear misaligned with today's exploit activity. The classes AI surfaces most often are not the classes dominating public exploits right now.
By class alone, you could conclude that AI is finding the wrong vulnerabilities. But the CVE-level data says the opposite.
In this cohort, 29 of 185 AI-discovered CVEs, or 15.6%, had a public exploit, compared with 4.10% across all 2026 CVEs. Four of the 185 AI-discovered CVEs appear in Securin KEV, or 2.16%, compared with 208 of 40,323 CVEs, or 0.52% of the 2026 baseline.
The easy mistake would be to treat the class-level gap as a reason to down-rank AI-discovered CVEs. After all, if the vulnerability classes AI is surfacing are not the same classes dominating today's weaponized volume, they may look less urgent through a traditional prioritization lens. And that's exactly the problem.Most prioritization models are built on yesterday's evidence: what's been exploited before, what was common before and what defenders have learned to act on fastest. AI may be changing the mix of vulnerabilities entering the system, which means past weaponization patterns may become a weaker guide to future risk.
That's the trap: the class-level signal says "different", but the CVE-level signal says "don't deprioritize."
What this looks like in practice: CVE-2026-42945
CVE-2026-42945 shows what this means operationally.
As noted above, the nginx rewrite module vulnerability moved from disclosure to 37 distinct public exploits in a little over a week.
That’s not a slow, theoretical risk waiting patiently in a backlog. It’s the distance between newly disclosed and already usable.
Several other AI-discovered CVEs with public exploits moved inside a single working week, including Parse Server JWT validation in one day, Windows IKE Service RCE in two days, Windows DNS Client RCE in three days and Windows TCP/IP RCE in eight days.
That timing matters. AI attribution cannot sit as an interesting metadata field while teams wait for every slower-moving signal to mature.
What defenders should do with this
AI-discovered CVEs should be evaluated as part of exposure management, not treated as novelty research.
Security teams should look closely at whether the affected component is widely deployed or infrastructure-critical; whether the vulnerability involves memory corruption, undefined behavior, type confusion or cryptographic verification; whether public exploit activity appears quickly after disclosure; and whether remediation requires source-level fixes rather than configuration-level mitigation.
There is no WAF rule for a use-after-free in nginx.
That’s the practical challenge. These vulnerabilities are not always easy to mitigate through configuration changes, compensating controls or application-layer filtering. Many require source-level remediation, vendor coordination, regression testing and careful rollout across components organizations depend on but may not fully control.
The risk is not simply that AI finds more CVEs. It’s that defenders may dismiss the wrong ones because they don’t look like yesterday’s exploitation patterns, while attackers treat them as tomorrow’s opening.
Share this post on:
