What is Project Glasswing and why is it relevant?

Project Glasswing is Anthropic's autonomous vulnerability research programme, which generated more than 23,000 vulnerability findings in the first half of 2026. Only 126 of those findings resulted in published CVEs, and just one has been confirmed as exploited in the wild. The programme illustrates both the scale of AI-assisted bug discovery and the gap between raw findings and genuinely exploited vulnerabilities.

If AI-found bugs aren't being exploited faster, what is driving exploitation acceleration?

VulnCheck's report shows that overall exploitation timelines are compressing regardless of discovery method. The median time from CVE publication to exploitation fell from 120 days to 80 days in 1H 2026, and 23.4% of Known Exploited Vulnerabilities were attacked on or before the day the CVE was published. The acceleration is happening across the board, not specifically in AI-discovered vulnerabilities.

AI Found 1,061 CVEs in Six Months. Only 14 Were Exploited.

Q: What did VulnCheck find about AI-discovered vulnerabilities in 1H 2026?

Of 1,061 CVEs attributed to AI-assisted vulnerability discovery in the first half of 2026, only 14 (1.3%) were confirmed as exploited in the wild. This matches the overall exploitation rate across all CVEs — AI-found bugs are not getting attacked at a higher rate than bugs found by conventional research. The report covers data from January through June 2026.

The dominant concern around AI-assisted vulnerability research has been scale: if AI systems can find bugs faster and in greater volume than human researchers, will defenders be overwhelmed by exploitable CVEs? VulnCheck’s State of Exploitation 1H-2026 report, published in July 2026, offers the first substantial dataset to answer that question. The answer is: not yet, and possibly not for the reason you’d expect.

Of 1,061 CVEs attributed to AI-assisted discovery in the first six months of 2026, only 14, or 1.3%, have been confirmed as exploited in the wild. That matches the overall exploitation rate across all CVEs in the period. AI-attributed vulnerabilities are not more dangerous, more targeted, or more exploited than anything else in the CVE catalogue.

The Scale of AI Bug Discovery

The 1,061 figure is itself worth pausing on. AI-assisted vulnerability research has moved well beyond academic proof-of-concept over the past two years. Dedicated programmes, internal red teams at major vendors, and third-party security firms are all using LLM-based tooling to systematically survey codebases at a scale that human researchers cannot match.

Anthropic’s Project Glasswing is the most prominent public example. In the first half of 2026, Glasswing generated more than 23,000 vulnerability findings. Of those, 126 resulted in published CVEs — a filtering ratio that reflects the difference between a plausible finding and a confirmed, reproducible, assignable vulnerability. Of those 126 CVEs, one has been confirmed as exploited in the wild.

That is a long funnel. 23,000 findings. 126 CVEs. One in-the-wild exploit. The raw discovery volume is impressive. The exploitation risk attached to Glasswing-attributed CVEs, based on current data, is not distinguishable from the baseline.

Other programmes and vendors contributed to the broader pool of 1,061 AI-attributed CVEs in the period, across both AI-specific products and conventional software. The 1.3% exploitation rate holds across the combined pool.

What Is Actually Accelerating

VulnCheck’s data does show acceleration in exploitation — just not specifically among AI-discovered bugs. The median time from CVE publication to confirmed exploitation fell from 120 days to 80 days compared to the prior period. And 23.4% of Known Exploited Vulnerabilities showed evidence of exploitation on or before the day the CVE was published.

That second figure is the sharper one. Nearly one in four KEV-added vulnerabilities were already being exploited before defenders had a formal CVE to act on. Roughly 200 CVEs were exploited within 31 days of publication in 1H 2026. The window for remediation continues to shrink, and it is shrinking for the broad CVE population, not just for any specific discovery methodology.

The implication is that the vulnerability management challenge of 2026 is primarily about speed and prioritisation, not about AI-discovered bugs creating a uniquely dangerous new attack surface.

Where AI Is Showing Up as an Attack Surface

The counterpart to AI not generating disproportionately exploited CVEs is that AI products are themselves a growing attack surface in the KEV data. VulnCheck’s report notes AI products emerging as a new category of exploited technology: model-building tools, workload-scaling platforms, AI gateways, and agent orchestration and workflow automation platforms.

This is consistent with the pattern documented elsewhere in 2026. Langflow, LiteLLM, n8n, LMDeploy, vLLM — AI infrastructure components have accumulated CISA KEV entries at a pace that reflects both their rapid adoption and the relative immaturity of their security posture. These are not bugs found by AI. They are bugs found in AI tooling, by conventional researchers and in some cases by threat actors.

The distinction matters. The security concern about AI in vulnerability research is that AI will discover and accelerate exploitation of bugs in conventional software. The actual 2026 pattern is different: AI is being used to discover bugs (at scale, with modest exploitation rates), and the products AI runs on are being exploited by threat actors at the same speed as any other high-value target.

Why the 1.3% Rate Is Not a Green Light

The VulnCheck data does not mean AI vulnerability discovery is risk-free or that defenders can deprioritise AI-found CVEs. Several caveats apply.

The 1H 2026 data captures a period when many AI-attributed CVEs are still relatively new. Exploitation rates increase over time as proof-of-concept code circulates, as the vulnerability appears in scanning signatures, and as more sophisticated threat actors incorporate it into their toolkits. A CVE assigned in April 2026 may show a very different exploitation rate by the end of the year.

The Glasswing funnel — 23,000 findings to 126 CVEs to 1 exploit — also reflects a selection process. Glasswing findings that do not meet the threshold for CVE assignment may include real vulnerabilities that are being exploited without a formal CVE record.

And the aggregate 1.3% rate obscures individual cases. One confirmed exploited CVE from 126 Glasswing-attributed entries is 0.8% — but that one CVE is CVE-2026-43499 (GhostLock), a Linux kernel privilege escalation that appeared in CISA KEV in July 2026. Not all 1.3% are equal.

The Headline Finding

The fear was that AI-assisted vulnerability discovery would flood the market with high-risk CVEs, compressing patch timelines and overwhelming triage capacity. The 1H 2026 data suggests that fear is not yet materialising in exploitation rates. AI is finding bugs. Defenders and attackers are both dealing with those bugs at roughly the rates they deal with everything else.

The compression happening elsewhere, where exploitation timelines for all CVEs are shortening and where nearly a quarter of KEVs are attacked before patch day, is the more immediate operational concern. AI-powered discovery is a factor to watch over the full product lifecycle. The pre-disclosure exploitation problem is a problem right now.