AI is finding software flaws faster than developers can fix them

AI-assisted security research has uncovered thousands of bugs across major software ecosystems, leaving companies and open-source maintainers struggling to triage and patch them before attackers can exploit them.

Tech companies are spending sharply more time on a problem created by their own defensive tools: artificial intelligence is now finding security flaws faster than human teams can comfortably process them. That shift is forcing major software makers and open-source maintainers to triage, patch and verify vulnerabilities at a pace that is beginning to strain normal development workflows, according to reporting by The New York Times and related coverage this month.

OpenAI has emerged as one of the clearest examples of the trend. In May, the company began using its systems to search for weaknesses in open-source code, and researchers inside and outside the firm identified more than 1,300 bugs. Fouad Matin, who leads OpenAI’s cyber-preparedness and safety operations, told The New York Times that AI “really opens this Pandora’s box of vulnerabilities”. He added that AI companies have a duty to help locate and repair the flaws they uncover, because the aim is to scan and patch as much software as possible.

The scale of the response is becoming visible elsewhere in the industry. Google said in June that artificial intelligence had helped it identify and repair 1,072 bugs in Chrome, while the company has fixed more severe bugs this year than in the previous eight years combined, according to the NYT report cited by PYMNTS. Microsoft has also accelerated its patching output, publishing 1,461 fixes this month alone, compared with 1,247 for all of 2025, the same report said. Google has separately been rolling out stronger Chrome warnings for suspicious and dangerous sites on desktop and Android, signalling that browser security is now being reinforced both through detection and user-facing alerts.

The burden is also landing on the people who maintain core infrastructure used across the web. Matteo Collina, chief technology officer at Platformatic and a maintainer of Node.js, told The New York Times that the surge is only beginning and said it would become “10 times worse”. Node.js has already received a record 50 vulnerability fixes this year, he said, while he has been working seven days a week to keep pace and using AI agents to handle tasks overnight. The pressure on open-source projects has also prompted debate over how to distinguish useful AI-assisted work from projects created or maintained with too little human oversight, a discussion reflected in recent rule changes on Reddit’s r/opensource community.

Recent findings show why the issue matters beyond software maintenance. OpenAI said its GPT-5.6 Sol model helped researchers uncover two critical PHP flaws, identified as CVE-2026-109618 and CVE-2026-109619, which could affect about 70% of websites where PHP is the server-side language. According to Tom’s Hardware, the weaknesses involved memory management and error-handling failures, and they were turned into working exploits within two weeks before patched versions were released. Axios likewise reported that the vulnerabilities had existed for more than a decade and led some organisations to take sites offline temporarily while fixes were applied.

For banks, payment firms and commerce platforms, the implications are broader than a single code base. As PYMNTS noted last week, many customer portals, merchant systems and third-party services depend on software that financial institutions do not directly control. A flaw in widely used infrastructure can expose customer data, disrupt transactions or give attackers a route into connected systems. AI-assisted security research is therefore creating a paradox for the industry: the same tools that can harden software are also increasing the number of defects that must be managed, documented and patched before they can be exploited.