AI Finds Bugs Faster Than Anyone Can Patch Them: MyTechDailyNews General Guide
If you rely on websites, cloud services, browser apps, or any online platform, the security underneath is under a new kind of pressure. Software flaws are being located faster than the people who maintain those systems can patch them, and the gap between discovery and repair is becoming a practical internet-safety problem rather than a specialist concern.
The debate was highlighted in a report by The New York Times, which describes how OpenAI, Google and Microsoft are using AI to hunt for defects while repair teams struggle to keep up. The question is no longer whether machines can find bugs, but whether defenders can absorb the flood of findings before attackers do.
A night that became a test for the OpenAI security team
On October 21, Fouad Matin, who works on cybersecurity preparedness and safety at OpenAI, had planned to spend the evening with friends for his birthday.
That day, he slept for about two hours while coordinating fixes for two serious security flaws found by AI. If exploited, the weaknesses could have affected a wide range of internet services. The response involved security researchers from startups and technology giants, as well as officials from the United States and other countries.
Matin's to-do list still contained more AI-discovered vulnerabilities waiting to be fixed.
OpenAI has assigned multiple teams to cybersecurity and is spending significant computing power to find and repair problems, Matin said. In his view, AI companies are responsible for addressing risks revealed by the technology, with a long-term goal of scanning and patching the world's software.
The repair load is rising across the industry
OpenAI said it began using its own technology to scan open-source software in May this year. Since then, internal and external researchers have used its models to find more than 1300 vulnerabilities. These programs are free to use and are widely deployed across online services, supporting many functions of the modern internet.
Google said that in June this year it used AI to find and fix 1072 vulnerabilities in the Chrome browser, exceeding the total fixed in the previous two years. Since the start of this year, the number of severe Chrome vulnerabilities patched has already surpassed the combined total of eight years.
Microsoft, for its part, released 1461 patches in October this year, exceeding the 1247 patches released across the whole of 2025.
What the numbers show
| Organization or project | Time point | Reported change |
|---|---|---|
| OpenAI | May this year | More than 1300 vulnerabilities found by its models since scanning open-source software began. |
| June this year | 1072 Chrome vulnerabilities found and fixed, above the previous two-year total; severe fixes this year exceed an eight-year total. | |
| Microsoft | October this year | 1461 patches, above the 1247 patches issued in the whole of 2025. |
Open-source maintainers feel it first
Matteo Collina, chief technology officer at Platformatic and a maintainer of Node.js, sees the shift from the front line. Uber and Netflix are among the companies that rely on Node.js.
Collina said, “What we are seeing now is only the first bit; the situation will get ten times worse.”
The OpenJS Foundation, which supports Node.js, said the project confirmed and fixed 50 security vulnerabilities this year, more than in any previous year. In February this year, the project received vulnerability reports at 4.6 times the normal rate.
This month, OpenAI contacted Collina again to warn him about one newly discovered vulnerability. A potential attacker could use it to break into internet-connected systems and steal data.
To deal with the increasing reports, Collina now works seven days every week, and leaves AI agents running tasks at night. He said, “No one really knows what this job will become.”
How AI changes vulnerability hunting
Finding software bugs used to depend heavily on individual experience. Companies hired security researchers to inspect code, and many programs paid bug bounty rewards to encourage white-hat hackers to discover and report issues.
AI is changing the speed and value of that work. It can search continuously, keep trying where a human researcher might give up, inspect small defects scattered across different code, and combine them into dangerous attack paths.
Volker Dusch, a security engineer at the PHP Foundation, feels the change directly. The PHP Foundation helps maintain the PHP programming language, and last week disclosed a serious vulnerability found by AI.
Two years ago, Dusch said, finding one security vulnerability was a major achievement. Today, the recognition that comes with it is fading, and the industry is changing how it evaluates the work.
More reports also means more noise
However, the rise in reports also brought a heavy extra burden.
Since late last year, open-source maintainers have noticed a clear rise in report volume. Some findings exposed serious threats, while others were low-quality AI-generated submissions that were confusing and untested.
In late January this year, the open-source project curl stopped paying bug bounties because it could not cope with the flood of incoming reports.
Defensive access does not mean the capability is rare
AI's offensive power is making defenders anxious. In April this year, Anthropic said its Mythos model had strong hacking ability and could not be safely released to the public. The company then used Project Glasswing to provide the model to a group of trusted companies and government agencies for inspecting and patching systems. OpenAI and Google also gave defenders AI models focused on cybersecurity.
Yet models capable of finding and using vulnerabilities are becoming easier to obtain. Vals AI recently set up a simulated cyberattack task requiring models to compromise a fictional company. In the test, an advanced OpenAI model available only to approved defenders completed 81% of the objectives. Close behind it was one model from Chinese company DeepSeek that can be freely accessed, completing 73%.
As such capabilities spread, security teams across Silicon Valley are accelerating their own checks because they worry the same vulnerability may soon be found by attackers too.
The PHP case shows where pressure lands
In July this year, researchers at cybersecurity company Calif began using AI agents to inspect PHP, a programming language reportedly used by about 70% of websites. The team found one vulnerability that had been hiding in the code for more than a decade and could let attackers run malicious code on affected sites.
Calif then contacted Dusch, as well as researchers at Wiz, a security company owned by Google, who had found a similar vulnerability. Engineers from OpenAI and the PHP Foundation joined the work.
The group collaborated for weeks in a private Slack channel and coordinated the repair through daily phone calls. Calif chief executive Thai Duong said the fix involved about 200 files and was a large-scale patch update.
While preparing the patch, the participants also notified government agencies and organizations such as Cloudflare, an internet infrastructure company, in the hope of broadening the reach of the fix.
The period in which the vulnerability had been found but not widely repaired became the most tense stage for everyone involved.
Cloudflare chief executive Matthew Prince said that during the past two months he had been in extreme fear, worried that others might discover the flaw first or that information could leak before a patch was ready.
He expects one internet-wide serious vulnerability to appear, on average every week, over the next two years.
The industry is divided on what comes next
Anthropic deputy chief information security officer Jason Clinton said on October 22, in a social-media post, that although the past four days had already been bad, things would worsen before improving.
Prince, by contrast, argued that finding these long-standing problems will ultimately make the internet safer. He expects the next two years to feel very bad, but believes that once this round of repair is complete people may reach a much safer internet.
Common misconceptions: what the AI bug rush is not
- It is not simply AI attackers versus human defenders. The same tooling is being used by OpenAI, Google, Anthropic, Calif, Wiz and open-source projects to find problems first.
- It is not true that every report is valuable. Maintainers now face both serious findings and low-quality AI-generated noise.
- It is not a problem limited to one company. OpenAI, Google, Microsoft, Node.js, curl, PHP and Cloudflare are all part of the story.
- It is not evidence that the internet is already failing. Faster discovery can mean more visible problems; a better-patched internet may emerge only after the current pressure is absorbed.
Action checklist for readers and software teams
- Follow official patch announcements from browsers, operating systems, server software and major web services, especially when a vulnerability is described as severe.
- For open-source projects and sites, treat new reports as a possible workload spike: triage them quickly, separate tested findings from noisy submissions, and document fixes in shared tools such as Slack.
- For AI-assisted scanning teams, remember responsibility for disclosure: if a model reveals a serious flaw, coordinate repair before details spread.
- For ordinary users, understand that visible patch activity may be a sign of defensive pressure, not only of chaos; keeping services updated is the simplest practical response.
FAQ
Why does AI finding bugs faster create risk?
Because the internet remains exposed during the window between discovery and wide deployment of a fix.
Is AI making security jobs less important?
Not exactly. It changes recognition: finding one security vulnerability is no longer the rare achievement it was two years ago, while the maintenance workload is growing.
What is the biggest near-term worry?
That widely available models, including DeepSeek's freely accessible option, can find and exploit flaws before defenders finish patching them.
The most useful way to understand this AI-driven bug rush is to separate discovery from repair. AI can point to weaknesses very quickly, but software safety still depends on people such as maintainers, vendors, researchers, infrastructure providers and governments turning findings into patches that reach real systems. For MyTechDailyNews readers, the practical signal is simple: the internet is being checked harder than ever, and the speed of response, not the number of alerts alone, will decide whether users end up safer or merely more anxious.