The background to all these incidents is a shift in who, or what, is looking for bugs. AI-assisted tools now find security flaws at a speed no human review process was built to absorb. This post collects the numbers, with honest limits on what they show.
What the numbers say
Coverage of Anthropic’s Project Glasswing reports that AI tools flagged 23,019 flaws in open-source software, 6,202 of them rated high or critical, with fewer than 1% patched so far. We have not been able to read Anthropic’s own page, so treat those figures as secondary reporting and check the primary source before quoting them.
IBM X-Force counted large year-on-year increases in public disclosures across four big vendors, from +204% to +2,456%, and +578% across all four. IBM is careful to say that AI as the cause is not established. The rise is real; the reason is not proven.
Microsoft’s October Patch Tuesday shows what the flood looks like on the receiving end. BleepingComputer counts about 1,411 fixes in the one release, a record, including three zero-days (one actively exploited, in the Windows Shell), and attributes the surge to Microsoft’s continued use of AI platforms to find and fix flaws in its own products. That count is the vendor’s, and the explanation is the reporter’s, not Microsoft’s.
On 1 October, Google paused its open-source vulnerability bounty because it was being flooded with low-quality, machine-written reports. That is the other side of the same coin: cheap discovery also means cheap noise, and maintainers, who are mostly volunteers, are the ones sorting it.
What it means for your code
- Disclosures will keep arriving in bursts. Expect weeks like this one to be normal.
- The window shrinks. If finding a bug is cheap, so is reproducing it from a patch. The time between a fix being public and attacks beginning gets shorter.
- Your dependencies are the surface. Most of your risk lives in code you did not write.
- Maintainers are overloaded. A fix may be slow to arrive for the small libraries you depend on.
What to do
- Make patching a routine, not an event: a weekly window, automated update pull requests, and tests good enough to trust them.
- Know what you run. Keep a software bill of materials, or at least a lock file for every project and a list of base images.
- Scan in CI. Dependency and vulnerability scanning (
govulncheck,npm audit,pip-audit) that fails the build. - Reduce what you depend on. Every library you remove is a feed of future advisories you will not read.
- Plan for compromise. Least privilege, segmented networks, backups you have tested, secrets you can rotate in an hour.
- Support the maintainers. Report clearly, fund what you rely on, and use AI to improve fixes and tests, not to spam reports.
The honest takeaway
Defenders can use these tools too. The advantage goes to whoever turns findings into shipped fixes fastest, and for a small team, speed comes from simplicity and automation, not headcount.