AI Is Finding Software Vulnerabilities 5x Faster. Is Your Patching Keeping Up?

Serious software vulnerabilities are being found and disclosed at a pace the industry has never seen. In July 2026, 21 major software organizations published about 2,500 high and critical severity CVEs in a single month, roughly five times the monthly record set before AI vulnerability hunting took off, according to Epoch AI’s analysis of CVE data. Microsoft’s July Patch Tuesday alone fixed 569 vulnerabilities, the largest release in its history.

For a small or midsize business, the takeaway is simple: a patch-once-a-month routine no longer matches how fast vulnerabilities are being found and weaponized. The businesses that stay safe over the next year will be the ones that patch quickly, know exactly what’s running on their network, and don’t leave old systems unpatched because “it still works.”

Why Did Vulnerability Disclosures Suddenly Spike?

In April 2026, Anthropic announced Claude Mythos Preview, an AI model able to find and exploit software vulnerabilities on its own, and launched Project Glasswing, a restricted program that gave the model to major vendors including Microsoft, Google, Apple and AWS so they could find and fix bugs in their own products first. Within about a month, Anthropic said Glasswing partners had identified more than 10,000 high and critical severity vulnerabilities.

The results showed up quickly in real products. Mozilla shipped a single Firefox update fixing 271 bugs the model found. Long-hidden flaws surfaced too, including a 17-year-old remote code execution bug in FreeBSD’s NFS code. Other AI labs have since released models with similar abilities, including open-weight models anyone can download and run.

In plain terms: the cost of finding a serious bug in software dropped dramatically in 2026, and both defenders and attackers have access to the tools that did it.

How Big Is the Increase, Really?

Epoch AI tracks high and critical severity CVEs published by 21 notable organizations, including Microsoft, Google, Apple, Cisco, Oracle, Adobe and the Linux kernel project. Before 2026, the busiest month on record was about 490. Here’s what happened next:

Epoch’s broader view, counting every organization that reports CVEs, shows the same curve continuing to climb through the rest of the year.

Two honest caveats. First, public CVE records don’t say which bugs were found by AI, so the link is timing, not proof, and Epoch notes some of the rise likely comes from more people hunting for bugs in general. Second, early reviews found AI tools tend to rate bugs as more severe than human reviewers later do. Even with both caveats, the direction is not in doubt: there are far more serious, publicly known vulnerabilities in common business software than there were a year ago.

Is This Good News or Bad News?

Both. Every bug found by a vendor and fixed is one an attacker can’t use later, and the companies with early access to these tools have been fixing their own software at record speed. Over time, that makes software safer.

The problem is the gap in between. Once a patch is published, it effectively tells attackers where the hole is. In its own published testing, Anthropic reported its model turning a Firefox patch into a working exploit in under an hour, and producing proof-of-concept crashes for Windows kernel patches in as little as 31 minutes. Compare that with history: WannaCry hit in 2017, 59 days after Microsoft released the patch that would have stopped it. Defenders used to have weeks. Now it can be hours.

Meanwhile, most businesses still patch on a monthly cycle, and plenty of devices quietly fall behind: the laptop that’s always off on patch night, the firewall nobody has logged into since installation, the line-of-business server everyone is afraid to reboot.

What Does This Mean for a Small Business?

Attackers don’t target small businesses because they’re interesting. They target them because they’re easy, and an unpatched system is the easiest way in. When thousands of new serious vulnerabilities are published every month, the number of easy targets goes up for anyone who isn’t keeping current.

The risk concentrates in a few places:

• Internet-facing devices. Firewalls, VPNs, remote access tools and email gateways are the first things attackers scan for. A known hole in one of these is an open door.
• Third-party applications. Windows Update handles Windows. It doesn’t patch your PDF reader, browser plugins, accounting software or the Java runtime a vendor installed five years ago.
• Old systems nobody owns. Unsupported operating systems and orphaned servers don’t get patches at all. Every new vulnerability disclosed against them stays open forever.
• Devices you don’t know about. You can’t patch what isn’t on your inventory.

Professional services firms in Houston and Dallas, such as law firms and CPA and financial advisory practices, feel this most because they hold exactly the client data attackers want and often run specialized software that’s slow to update.

How Fast Should You Be Patching Now?

Speed matters more than perfection. A practical standard for 2026:

1. Critical patches on internet-facing systems within 48 to 72 hours. Firewalls, VPNs and remote access tools go to the front of the line, especially when a vulnerability is listed as actively exploited.
2. Workstation and server patches within a week, not a month. Automate deployment, and follow up on devices that miss the window instead of waiting for next month’s cycle.
3. Patch third-party applications too. Browsers, PDF tools and common business apps need the same automation as Windows.
4. Keep a live inventory. Every device, every application, every version. Vulnerability scanning tells you what’s actually exposed, not what you assume is patched.
5. Retire what can’t be patched. If a system is out of support, put a date on replacing it or isolating it from the rest of the network.
6. Layer defenses for the gap. Even fast patching leaves hours or days of exposure. Endpoint detection and response, MFA and network segmentation limit the damage if something gets through first.

This is exactly the kind of work that’s hard to keep up with internally and straightforward to run as a managed service. Braintek’s managed IT services include automated patching for Windows and third-party apps, and our cybersecurity services add vulnerability scanning and endpoint protection on top. If you’re not sure where you stand, a cybersecurity risk assessment will show which systems are behind and what to fix first.

Frequently Asked Questions

What is a CVE?

A CVE (Common Vulnerabilities and Exposures) is a public identifier for a specific security flaw in a specific piece of software, like CVE-2026-4747. Vendors and researchers publish CVEs so everyone can track the same bug and confirm it’s been fixed.

Did AI cause the increase in vulnerabilities?

AI didn’t create the bugs. They were already in the code, some for decades. What changed is that AI made finding them much faster and cheaper. Public CVE data doesn’t record which bugs AI found, but the timing of the surge lines up closely with AI vulnerability hunting going mainstream in 2026.

Can attackers use the same AI tools?

Yes. Anthropic restricted access to its most capable model, but other labs have released models with comparable vulnerability-finding ability, including open-weight models that anyone can run. Assume attackers can analyze a new patch and build an exploit quickly.

Is monthly patching still enough?

Not for critical issues. Monthly patching made sense when exploits took weeks to appear. With exploit timelines now measured in hours or days for some vulnerabilities, critical patches on exposed systems should go out within a few days, and everything else within about a week.

What’s the first thing a small business should do?

Find out what you have and how far behind it is. A device and software inventory plus a vulnerability scan shows your real exposure, and usually turns up a few forgotten systems that need attention right away.

Find out how far behind your patching really is

In a 15-minute discovery call, we’ll talk through how your business handles patching today and where the gaps are most likely hiding.

Braintek

Visit Our Business Listing Visit Website