Most AI-found security flaws still go unexploited, data shows

VulnCheck found that of 1,061 security vulnerabilities discovered by AI in the first half of 2026, only 14 (1.3%) saw confirmed exploitation — the same rate as vulnerabilities overall. The median time to exploitation, however, dropped from 120 days to 80.

Why it matters: This tempers the narrative that AI vulnerability discovery is fueling a wave of new attacks, while the faster exploitation timeline suggests AI is compressing the window defenders have to patch — a useful counterpoint to recent claims about AI-accelerated bug hunting outpacing patching.