AI models from frontier labs will keep discovering critical software vulnerabilities faster than the broader ecosystem can patch them, creating recurring mass-exploitation windows distinct from agentic misalignment incidents.

confidence 0.6 · horizon 2027-10-23 · status open

Falsifiers

A full calendar year passes with no AI-discovered critical vulnerability followed by mass exploitation before majority patching.
OpenAI or Anthropic publishes and holds to a formal coordinated-disclosure policy for AI-discovered vulnerabilities, with no leak-before-patch incident recurring for two consecutive quarters.
Independent CVE-tracking data shows time-to-patch improving as fast as or faster than AI-discovered vulnerability volume over two consecutive quarters.

+2 CISA and security researchers confirm successful exploitation of PHP vulnerabilities — Confirmed successful exploitation of the previously-flagged PHP vulnerability reverses the prior week's 'slower pace' counter-evidence and directly supports the thesis that AI-discovered vulnerabilities can outrun patch capacity, though the available reporting is brief and doesn't give exploitation scale.
-1 Exploitation of the AI-discovered PHP flaw moves slower than expected, but millions remain at risk — Security researchers reporting PHP exploitation moving slower than expected, with no mass compromise yet despite the earlier AI-discovered flaw leaking before patching, is mild counter-evidence to the thesis that AI-discovered vulnerabilities are outrunning patch capacity, though millions of systems remaining at risk keeps the underlying concern open.
+2 "Black October": AI-driven attack framework breaches ConnectWise and ripples into a wider vulnerability-disclosure wave — A Microsoft-attributed, TechCrunch-corroborated AI-agentic attack plus a reported AI-discovered PHP vulnerability that leaked before patching is direct, if partly single-sourced, evidence for the proposed thesis that AI-discovered vulnerabilities are outrunning patch capacity.