Published Wednesday, September 30, 2026 at 11:42 AM PT
BLUF: Vulnerability exploitation rates have doubled year-over-year, rising from an average 10.5 per month (2025) to 18 per month (Jan–Aug 2026). Google Threat Intelligence attributes acceleration to adversaries leveraging AI for automated discovery, exploitation, and attack chain orchestration. Organizations should immediately audit patch cadence and threat-detection coverage for AI-discovered CVEs; zero-day exploitation is tracking upward in parallel.
DETAILS:
Exploitation rate doubled. Average vulnerabilities exploited: 10.5/month in 2025 → 18/month Jan–Aug 2026. Confirmed by Google Threat Intelligence analysis.
Zero-day component increasing. Zero-day exploitation rates are rising concurrently; full quantification truncated in source, but trajectory is upward per GTIG.
AI-assisted attack chains. Threat actors (both state and non-state) are automating vulnerability discovery, validation, and exploitation using AI agents. Attack pace and profile changing materially.
AI assets targeted as force multiplier. Adversaries with wide-ranging motivations are targeting AI infrastructure and models to operationalize their own attack automation, expanding reach and speed.
AI-discovered vulnerabilities weaponized faster. Vulnerabilities surfaced via AI-assisted discovery tools are moving from disclosure to active exploitation in tighter windows than human-discovered flaws.
IMPACT:
- All organizations — increased volume of novel exploitation attempts and shorter response windows between disclosure and weaponization.
- Cloud/SaaS providers — elevated risk from AI-accelerated supply-chain reconnaissance and lateral movement.
- AI developers and ML ops teams — direct targeting of inference infrastructure, training pipelines, and model weights.
- Security teams — existing patch/detection SLAs increasingly inadequate; automation and ML-powered detection required to maintain parity.
RECOMMENDED ACTIONS:
Immediate: Audit your current vulnerability patch SLA; if >30 days, escalate to ops leadership. Target 7–14 day remediation for remotely exploitable flaws (raised from 30–60 day historical norms).
Parallel: Deploy behavioral AI/ML-based threat detection on network perimeter and endpoints. Signature-only detection will not catch AI-accelerated attack chains.
Week 1: Inventory all externally facing services and AI assets (inference endpoints, training infra, model registries). Flag those lacking EDR/detection.
Ongoing: Subscribe to zero-day intelligence feeds (Google GTIG, CISA KEV, vendor advisories). Manual vulnerability scanning is now insufficient for early warning.
SOURCES:
- Google Threat Intelligence (GTIG): Vulnerability Discovery and Exploitation Trends in the AI Era
- Corroborating reports: Help Net Security, SecurityWeek, News4Hackers, CSO Online (all Aug–Sep 2026)
STATUS: Confirmed trend. Not a discrete incident.
Recent high-severity events at publish time:
