The vulnerabilities AI finds are the ones attackers want
GTIG says AI-found flaws skew toward remote code execution, and attackers hit BeyondTrust CVE-2026-1731 within four days.
Google Threat Intelligence Group reviewed vulnerability data from January 2025 through August 2026 and found monthly CVE disclosures doubled, from 5,045 to 10,740, while only 0.23% were exploited. GTIG recorded 141 exploited vulnerabilities in the first eight months of 2026, above 127 for all of 2025, and zero-days rose from about 8 to 11 per month. Half of flaws likely discovered by AI led to remote code execution, versus 26% of others. Unauthenticated command injection CVE-2026-1731 in BeyondTrust Privileged Remote Access and Remote Support, found by Hacktron, was exploited within four days; confirmed exploited AI-software flaws include LiteLLM CVE-2026-42271 and Langflow CVE-2026-5027 and CVE-2025-3248.
- Monthly CVE disclosures rose from 5,045 in January 2026 to 10,740 in August.
- GTIG recorded 141 exploited flaws through August, versus 127 in all of 2025.
- Half of likely AI-discovered flaws enable remote code execution, versus 26% otherwise.
- Attackers exploited BeyondTrust CVE-2026-1731 within four days of disclosure.
- Flowise and Langflow account for about half of 2026 AI-software vulnerability disclosures.
Vulnerabilities mentionedAll →
- CVE-2025-32489.8100%Unauthenticated RCE in Langflow /api/v1/validate/codepublished · Langflow KEV ransomware PoC ×2
Full article642 words · extracted from helpnetsecurity.com · click to collapse
Attackers exploited a flaw found by an AI research agent within four days of its public disclosure, and they are exploiting more vulnerabilities overall, according to new research by Google Threat Intelligence Group (GTIG).
The researchers examined vulnerability disclosure and exploitation data from January 2025 to August 2026.
Disclosures doubled, exploitation stays rare
Monthly CVE disclosures doubled in 2026, from 5,045 in January to 10,740 in August. Only 0.23% of the vulnerabilities disclosed this year, or about one in 431, were observed exploited in the wild.
GTIG recorded 141 exploited vulnerabilities between January and August 2026, more than the 127 exploited in all of 2025. Zero-day exploitation grew from an average of 8 per month in 2025 to 11 per month in 2026.
The researchers suggest most of the growth in exploitation comes from n-days. “It is possible that threat actors are finding it more accessible or efficient to use LLMs and AI tools” to analyze patches, disclosure announcements and proof-of-concept code “to rapidly weaponize n-days,” they said.
GTIG rates vulnerabilities with its own risk ratings, which differ from CVSS severity scores. Exploitation of vulnerabilities it rates High Risk went from 28 in 2025 to 75 in the first eight months of 2026.
AI finds more serious flaws
Half of the vulnerabilities GTIG identified as likely discovered by AI lead to remote code execution, compared to 26% of those found by other means.
(Source: Google)
AI-discovered vulnerabilities are also less likely to be low risk. Of these, 39% were rated Low Risk and 58% Medium Risk, while vulnerabilities found by other means were 69% Low Risk and 28% Medium Risk.
The researchers say this “largely likely reflects how research programs scope and deploy these systems,” since those programs task AI agents with auditing infrastructure and sensitive privilege boundaries.
GTIG notes that public data undercounts AI-discovered vulnerabilities. CVE records have no standard tag for AI attribution, and cloud and SaaS providers often fix AI-found flaws in production without requesting CVE IDs.
Attackers moved fast on an AI-found flaw
CVE-2026-1731, an unauthenticated OS command injection vulnerability in BeyondTrust Privileged Remote Access and Remote Support, was discovered by the Hacktron AI research agent.
Threat actors used it in targeted initial-access campaigns. GTIG saw one threat cluster exploit it within four days of public disclosure, and five more within seven days. The attackers escalated privileges, exfiltrated data and dropped payloads including SNOWLIGHT, SPARKRAT and cryptominers.
“Defensive AI agents are uncovering high-impact vulnerabilities that threat actors actively seek to exploit,” the researchers noted.
AI orchestration tools are the top target
GTIG tracked 2,076 vulnerabilities in AI-related software between January 2025 and August 2026, over 1,500 of them disclosed in 2026. Half of this year’s disclosures affect agent orchestration frameworks such as Flowise and Langflow, where attackers exploit code execution nodes “via prompt injection or crafted workflow JSONs,” the researchers explained.
Inference and serving software such as vLLM, Ollama and LiteLLM had 212 vulnerabilities disclosed in 2026. Nearly a quarter of them stem from unauthenticated API endpoints or server-side request forgery, which can let attackers bypass perimeter firewalls, use up GPU resources or extract model checkpoints.
Compromised enterprise AI gateways can expose third-party API keys and “private prompt streams containing personally identifiable information (PII) or proprietary source code,” GTIG warned.
Only a handful of AI-related vulnerabilities have been confirmed as exploited in the wild. They include a command injection flaw in LiteLLM (CVE-2026-42271) that leads to host takeover and API credential theft, and two Langflow flaws (CVE-2026-5027 and CVE-2025-3248) that let attackers write files to the host or run code remotely.
GTIG expects vulnerability discovery and exploitation to keep rising in the short to medium term.
“To counter the increased risk from rapid vulnerability discovery and exploitation, organizations must transition from unprioritized mass-patching to threat-intelligence-driven triage, combining targeted edge-defense with automated, agentic remediation,” reseachers concluded.