AI uncovers security vulnerabilities: Why companies need to act even faster now.

Anthropic sends its regards: The flood of CVEs is increasing dramatically

According to a recent analysis by Epoch AI, approximately 1,500 serious security vulnerabilities (High and Critical CVEs) were disclosed in June 2026. CVE (Common Vulnerabilities and Exposures) is an internationally standardized system for uniquely identifying publicly known security vulnerabilities in software and IT systems.

This is more than 3.5 times the previous monthly record. One month later, the number rose to around 2,500 published vulnerabilities.

The increase coincides with the introduction of powerful AI models that are increasingly capable of autonomously detecting software bugs and vulnerabilities. Anthropic reported that its “Claude Mythos” model had already identified thousands of critical vulnerabilities as part of a security program. Other providers are also pursuing similar initiatives.

Importantly, the data shows a correlation but no direct proof that AI alone is responsible for the increase. Nevertheless, many security experts agree that AI is massively accelerating the discovery of vulnerabilities.

More vulnerabilities do not automatically mean more risk

The growing number of CVEs does not necessarily mean that software has become less secure. In fact, the opposite is often true: vulnerabilities are being identified, documented, and fixed more quickly.

The real challenge today lies in prioritization. Not every vulnerability classified as critical is actually being actively exploited. Modern security programs therefore take into account not only the technical severity but also the current threat landscape and additional risk data—such as associated malware, the likelihood of exploitation, the availability of a proof-of-concept (PoC) exploit, or whether a vulnerability has already been weaponized, meaning it can be exploited automatically using publicly available or easily deployable exploits. It is precisely this risk-based approach that is increasingly gaining acceptance across the industry.

The attack surface is shifting

While AI helps with defense, it also opens up new attack vectors. In early 2026, security researchers at Check Point disclosed several critical vulnerabilities in AI-powered development tools. Attackers were even able to execute program code on developers’ computers and steal login credentials using manipulated project data.

The lesson here is that, going forward, companies must not only protect their traditional applications but also the AI tools themselves, which are increasingly being used in development and operational processes.

What You Should Do Now

The number of reported vulnerabilities will continue to rise in the coming years. It will become increasingly important for IT departments to

• identify infrastructure, shadow IT, and attack surfaces,
• continuously detect vulnerabilities,
• intelligently prioritize risks,
• ensure comprehensive and effective patch management,
• roll out patches more quickly,

and incorporate AI systems into their security strategy.

Those who still rely on manual processes today will struggle to keep pace with the rapidly evolving threat landscape. The number of reported vulnerabilities is growing faster than the resources available to many IT departments

Identify Risks Early with UMB Vulnerability Management as a Service

UMB helps companies identify risks early and reduce them effectively through Vulnerability Management as a Service. UMB customers benefit from the experience gained across UMB’s customer base, which encompasses a wide variety of infrastructures and requirements—particularly when it comes to prioritizing, implementing, and coordinating security measures.

The UMB Security Angel ensures maximum security.

The UMB Security Angel ensures maximum security.