AI finds plenty of security flaws, but almost none of them get exploited

Editor's take

AI tools are identifying a significant volume of security vulnerabilities, yet the rate at which these flaws are actively exploited by attackers remains remarkably low, mirroring the exploitation rate of human-discovered vulnerabilities. This suggests that while AI is proving adept at finding weaknesses, the practical application of these discoveries by malicious actors hasn't yet scaled proportionally, nor has it introduced a novel attack vector through sheer volume of AI-generated exploit chains.

This finding is critical for understanding the immediate impact of AI on cybersecurity. It implies that current AI vulnerability discovery, while efficient, doesn't automatically translate to an increased immediate threat landscape. Security teams may be able to prioritize human-discovered, higher-risk exploits without being immediately overwhelmed by a wave of AI-generated attacks, though the long-term implications of AI-assisted exploit development remain a concern.

The key question moving forward is whether this low exploitation rate is a temporary state or a persistent trend. It will be important to monitor if attackers develop more sophisticated methods to leverage AI-discovered vulnerabilities, or if the sheer volume of AI-generated findings eventually saturates the exploit market, making it harder for attackers to focus on specific, high-impact flaws. The emergence of AI-powered exploit generation tools, beyond simple vulnerability identification, will be a crucial indicator.