AI Chatbots Are Finding Security Flaws Faster Than Anyone Can Patch Them
Even as AI labs debate slowing down, off-the-shelf chatbots are surfacing software vulnerabilities at a pace that outstrips the industry's ability to fix them.
The argument over whether to slow AI development keeps making headlines, but a quieter problem is already here: ordinary chatbots are being used to find software security flaws faster than defenders can respond. According to reporting from Wired, the same publicly available models that labs are debating how to restrain are already helping researchers and attackers surface a growing wave of vulnerabilities. The bottleneck has shifted from discovering bugs to fixing them.
The tools involved are not exotic. Widely deployed assistants from OpenAI, Anthropic, Google and others can read code, suggest likely failure points and draft proof-of-concept exploits with minimal prompting. That lowers the skill floor for vulnerability research, which was once the domain of specialists who spent years learning reverse engineering and fuzzing. A capable model now compresses hours of manual triage into minutes, and it never gets tired.
The numbers point in one direction. Vulnerability disclosures have climbed sharply in recent years, and the U.S. National Vulnerability Database has struggled to keep pace, at times processing submissions faster than analysts can enrich and publish them. When discovery outruns remediation, the backlog itself becomes a risk: unpatched flaws sit in production systems while maintainers work through queues they cannot clear.
The irony is hard to miss. AI labs have floated industry-wide agreements to pace development, citing risks from increasingly capable systems. Yet the vulnerability surge is coming from models that are already shipping, not from some future frontier system. Slowing the next generation of training runs would do little about flaws being found today with tools anyone can rent by the token.
The practical burden falls on software maintainers, many of whom work on open-source projects without dedicated security staff. A flood of machine-generated reports can drown volunteers in low-quality submissions, and separating genuine bugs from noise is its own labor problem. Some projects have begun requiring reproduction steps or limiting AI-written reports outright.
What to watch next is whether the security ecosystem can scale its response. Bug bounty platforms, maintainer groups and regulators are all weighing how to handle machine-speed disclosure, and some are experimenting with AI-assisted triage to fight fire with fire. The open question is whether patching, testing and deployment can ever move as quickly as the models doing the finding.