The AI era has triggered a new cybersecurity arms race in which attackers and defenders are both using machine learning to find and exploit software vulnerabilities faster than ever. According to security experts, attackers are ramping up AI-powered exploit development, while security teams are deploying AI-driven detection and patching workflows to respond in real time.
This acceleration is reshaping the economics of software security: the speed of vulnerability discovery no longer matches the slower pace of traditional analysis, triage, and patching, creating a dangerous imbalance between how quickly bugs are found and how quickly they can be fixed. The main issue is the flood of AI-generated bug reports overwhelming existing programs. Curl ended its bug bounty program after being inundated with low-quality submissions generated by AI tools. Linux’s security mailing list has become “almost entirely unmanageable” due to high volumes and duplicate AI bug reports from automated scanners.
Google recently overhauled its Vulnerability Reward Programs for Chrome and Android, lowering payouts for some bug classes while increasing others to focus on the most challenging and impactful vulnerabilities. These changes show that the industry is struggling to sort useful findings from noise while keeping costs sustainable. The same AI tools that help defenders also help attackers, which is the core asymmetry of this arms race. AI systems can now scan entire codebases, detect subtle patterns humans miss, and generate exploit code in days or even hours instead of months.
Historically, exploiting a vulnerability could take years; now, exploits can emerge within 24 hours after discovery. This compression of the timeline means developers have less time to patch, attackers can automate exploitation, and low-skilled hackers gain advanced capabilities that were once reserved for elite teams. The result is a shrinking window between finding a flaw and it being weaponized.
Organizations are responding with a mix of economic and structural measures. Some researchers argue that companies cannot simply “patch their way out of this” and must instead build infrastructure that makes many bugs irrelevant in practice. The industry is shifting toward “secure by default” designs, automated scanning in release candidates, and security-first development practices that reduce the number of exploitable weaknesses from the start. Google’s payout adjustments reflect a strategic shift to reward only the most impactful vulnerabilities, while smaller firms may struggle to keep up with rising costs and report volumes.
The long-term issue is that vulnerability discovery is no longer a human-limited process but a machine-driven one, changing the balance of power in cybersecurity. AI exposes weaknesses faster than communities can respond, and the backlog of bugs now grows faster than it can be resolved. The winners will be those who treat security as continuous defense-in-depth, not as a one-time fix, and who build systems where most bugs are made irrelevant by design rather than by constant patching.
This article has been indexed from CySecurity News – Latest Information Security and Hacking Incidents
Read the original article: