AI Security

AI Discovery Is Flooding Vulnerability Backlogs

Gartner’s 2Q26 survey put AI vulnerability discovery at the top emerging cyber risk, and Kaspersky said Q2 2026 brought an unprecedented surge in registered CVEs. Kaspersky also said new vulnerability classes appeared in Linux networking, and that OpenClaw was among the most affected AI projects, with more than 200 CVEs in the quarter.

The shift is speed and volume at once: AI tools can sift huge codebases for flaws and help turn them into working exploit code quickly, while the same tooling is also surfacing new bugs in AI products and AI-generated code. That shrinks the time between found and weaponized and pushes more issues into patch queues than normal review cycles can clear.

For teams running AI development stacks, Linux-heavy infrastructure, or AI products like OpenClaw, the exposure is now a backlog problem as much as a tooling problem. The reporting does not say the surge is slowing, only that discovery and exploitability are moving faster than the cadence most organizations use to absorb them.

4 sources · Aug 27

CVE-2026-25253

NVD KEV

CVSS 8.8 HIGH: openClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically… EPSS 24% (98th percentile).

Timeline

Aug 27 Reported by Dark Reading
Aug 26 Reported by CISA Advisories

Sources

Aug 27 Dark Reading
Agentic AI Risks, CVE Program Concerns Permeate Black Hat 2026
This installment of the Reporters' Notebook video series discusses several topics such as AI's effects on vulnerability reporting and security research.
original
Aug 26 CISA Advisories
CISA Vulnerability Review | CISA
This review provides a baseline of the vulnerability landscape before AI-enabled vulnerability discovery becomes widespread to help organizations fix preventable software flaws, close exposure gaps and strengthen resilience against real-world cyber threats.
original
Aug 26 Kaspersky Securelist
Analyzing the vulnerability landscape in Q2 2026
This report covers statistics on vulnerabilities, exploits, and C2 frameworks in Q2 2026.
original

Part of the PlainSec briefing for 2026-08-26

Every edition of this story: AI Discovery Is Flooding Vulnerability Backlogs

More from today

AI SecurityAI Discovery Is Flooding Vulnerability BacklogsGartner’s 2Q26 survey put AI vulnerability discovery at the top emerging cyber risk, and Kaspersky said Q2 2026 brought an unprecedented surge in registered CVEs. Kaspersky also said new vulnerability classes appeared in Linux networking, and that OpenClaw was among the most affected AI projects, with more than 200 CVEs in the quarter.The shift is speed and volume at once: AI tools can sift huge codebases for flaws and help turn them into working exploit code quickly, while the same tooling is also surfacing new bugs in AI products and AI-generated code. That shrinks the time between found and weaponized and pushes more issues into patch queues than normal review cycles can clear.For teams running AI development stacks, Linux-heavy infrastructure, or AI products like OpenClaw, the exposure is now a backlog problem as much as a tooling problem. The reporting does not say the surge is slowing, only that discovery and exploitability are moving faster than the cadence most organizations use to absorb them.4 sources · Aug 27

CVE-2026-25253

NVD KEV

CVSS 8.8 HIGH: openClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically… EPSS 24% (98th percentile).

Timeline

Aug 27 Reported by Dark Reading

Aug 26 Reported by CISA Advisories

Sources

Aug 27 Dark Reading

Agentic AI Risks, CVE Program Concerns Permeate Black Hat 2026

This installment of the Reporters' Notebook video series discusses several topics such as AI's effects on vulnerability reporting and security research.

original

Aug 26 CISA Advisories

CISA Vulnerability Review | CISA

This review provides a baseline of the vulnerability landscape before AI-enabled vulnerability discovery becomes widespread to help organizations fix preventable software flaws, close exposure gaps and strengthen resilience against real-world cyber threats.

original

Aug 26 Kaspersky Securelist

Analyzing the vulnerability landscape in Q2 2026

This report covers statistics on vulnerabilities, exploits, and C2 frameworks in Q2 2026.

original

Part of the PlainSec briefing for 2026-08-26Every edition of this story: AI Discovery Is Flooding Vulnerability BacklogsMore from today

OpenAI’s Agent Test Turned Into a Coordinated Breach

NemoClaw’s Local Model API Stays Reachable