AI Can Surface More Vulnerabilities Than Ever. Humans Still Have to Decide What Comes Next.

For years, cybersecurity teams have operated under a simple assumption: if we could find more vulnerabilities faster, we would make software more secure.

Artificial intelligence is testing that assumption. As the broader AI conversation shifts from rapid adoption to measurable value, cybersecurity is exposing a challenge that won’t disappear with an AI slowdown. Organizations are already facing a growing volume of AI-generated vulnerability findings that still require human validation, prioritization, and remediation.

Recent findings from Project Glasswing offer one of the clearest examples yet. Claude Mythos Preview reportedly identified more than 26,000 vulnerability findings across software projects in just a few months. Yet according to an independent analysis of Glasswing’s public disclosure ledger, only about 10% of those findings have reached the disclosure process, and fewer than 1% have ultimately been patched.

Those numbers are striking, but they shouldn’t be surprising. The industry has spent decades optimizing for discovery. What it hasn’t built is the capacity to process vulnerability findings at AI scale.

The bottleneck in cybersecurity is no longer discovery. It’s what happens next.

Finding Vulnerabilities Was Never the Hardest Part

In an early update from Project Glasswing, Anthropic noted that progress was increasingly constrained not by finding vulnerabilities, but by the human work required to verify reports, coordinate disclosures, and support remediation efforts. The company also noted that some maintainers requested slower disclosure rates because they lacked the capacity to process the volume of findings being generated.

This distinction matters because vulnerability discovery and vulnerability remediation are fundamentally different activities.

Discovery is increasingly a pattern-recognition problem. Modern AI systems excel at analyzing large codebases, identifying unusual behavior, tracing execution paths, and surfacing potential weaknesses.

Remediation is different. Fixing a vulnerability requires context. Someone must determine whether the issue is legitimate, understand the potential impact, evaluate possible fixes, ensure changes do not introduce regressions, coordinate disclosure timelines, communicate with stakeholders, and ultimately accept responsibility for the outcome.

That last part is critical. AI can identify a possible vulnerability, but it cannot be accountable for what happens next. Validating, triaging, fixing, and reporting will always require a human who is accountable to the project they maintain. And that takes time from people who often have a full-time job, a family, other obligations competing for their attention. In many open source projects, the limiting factor isn’t visibility into risk; it’s the capacity of maintainers and security teams to responsibly evaluate and respond to an ever-growing volume of findings.

This is the fundamental difference between discovery and remediation. Discovery is increasingly a problem that AI can help us scale. Remediation still depends on people who have the context, authority, and accountability to act on what AI finds.

The Open-Source Challenge

This dynamic becomes even more apparent across the open source ecosystem. With open-source components present in 98% of commercial codebases, the vast majority of the world’s digital infrastructure relies on projects maintained by relatively small groups of contributors.

In many cases, the people responsible for maintaining this critical software are volunteers or individuals balancing project responsibilities alongside full-time jobs and personal obligations. As AI increases the volume of software and vulnerabilities discovered within it, the capacity of those maintainers to keep pace becomes an increasingly important part of the security equation.

When an AI system suddenly generates hundreds or thousands of potential findings against a project ecosystem, those maintainers become the limiting factor.

This isn’t a criticism of maintainers. It’s a reflection of reality.

Even before the emergence of AI-powered vulnerability discovery, many open-source projects struggled with limited resources, growing security expectations, and increasing maintenance burdens. AI is accelerating pressure on a system that was already stretched thin.

The challenge is not simply determining whether a vulnerability exists. The challenge is everything that happens afterward.

Someone has to review the report. Someone has to reproduce the issue. Someone has to decide whether it represents a security risk. Someone has to develop and test a fix. Someone has to coordinate disclosure and release updates. Those responsibilities cannot simply be automated away.

As AI-generated findings continue to increase, organizations that rely on open-source software will increasingly depend on the health and sustainability of the people maintaining it.

Preparing for the AI Vulnerability Discovery Surge

So what should enterprises do? First, organizations need to recognize that AI-driven discovery is not a future problem. It is already happening. Project Glasswing demonstrated that frontier models can uncover vulnerabilities at a scale that would have been difficult to imagine only a few years ago.

Second, security leaders should evaluate whether their remediation processes can scale alongside discovery capabilities. Many organizations have invested heavily in finding vulnerabilities while underinvesting in the people and processes responsible for resolving them.

Third, enterprises should pay closer attention to software maintenance as a security function. Security is often discussed in terms of prevention and detection, but long-term maintenance remains one of the most important and underappreciated components of risk management. AI may be making vulnerabilities easier to find, but it does not reduce the responsibility of keeping critical software secure over time. Organizations need a strategy for lifecycle ownership that allows them to modernize deliberately, rather than being forced into rushed migrations or reactive remediation efforts when risks emerge.

Finally, organizations should support the broader ecosystems they depend on. As AI accelerates vulnerability discovery across open-source software, maintainers will face increasing demands. The security of the software supply chain ultimately depends on whether those maintainers have the resources needed to respond.

AI can find vulnerabilities faster. But finding them does not make software secure. The harder work is validating risk, prioritizing what matters, delivering tested fixes, and maintaining secure software over time. As vulnerability discovery accelerates, organizations will need a continuous remediation capability backed by expertise, accountability, and clear service levels.

Because the hardest problem in cybersecurity isn’t finding the vulnerability. It’s what happens next.