Google report finds vulnerability disclosures doubled in 2026 as AI shifts the kinds of flaws being found

Google Threat Intelligence Group says software vulnerability disclosures climbed sharply in 2026, roughly doubling from January to August, while exploitation also rose. The report argues AI is changing not just how many flaws are found, but which kinds: vulnerabilities it identified as likely AI-discovered were more likely to enable remote code execution and more likely to land in its medium-risk tier than non-AI findings. Google also said it has already seen at least one AI-discovered flaw exploited in the wild, citing CVE-2026-1731 in BeyondTrust products. Separately, the company tracked 2,076 AI-related CVEs from January 2025 through August 2026, with more than 1,500 of them disclosed in 2026, though only a handful have been confirmed exploited in the wild.