AI Today: More bugs, the same attacks, less time
AI is finding software flaws at twice last year's rate. They are no more likely to be exploited. What is shrinking is the time defenders have to fix them.
Four days before this week's PHP security flaws were made public, someone was already trying to use one. WIRED reported that Amazon's threat intelligence team saw the attempt on 17 October. The fixes did not arrive until the 21st.
AI Today is a series from Fíor, a natural language classifier that predicts whether a piece of text was more likely written by a person or by AI. Each piece explains one development in AI and shows where the claims come from.
The flaws, known as PHP2Shell, were found with AI help, by researchers working through an OpenAI programme and separately at Wiz. They had sat for years in PHP, the language behind an estimated 70% of websites. Details leaked before the planned disclosure, and governments told organisations to patch at once or take sites offline. We looked at how the news covered it in Analyzing the News.
The episode is being read as proof that AI is tipping security towards attackers. The numbers are more careful than that.
More bugs, the same rate of attacks
AI is finding far more flaws. VulnCheck, a firm that tracks which vulnerabilities attackers actually use, says flaws found with AI help are arriving at roughly twice last year's rate.
They are not, so far, more attractive to attackers. In the first half of 2026, VulnCheck counted 1,061 vulnerabilities found with AI assistance. Fourteen of them, or 1.3%, were confirmed as exploited. That is about the same rate as every other vulnerability over the same period. Researchers who spoke to Reuters made a similar point: some AI-found bugs are hard to turn into a working attack at all.
Less time
What is changing is the clock. VulnCheck found that the median time between a flaw being published and attackers exploiting it fell from 120 days in 2025 to 80 days in the first half of this year.
PHP2Shell was an extreme case. Because the details leaked, attackers had them before most defenders had a fix. In the first hours, security firms did not even agree on whether attacks had started. Some said they had seen none, while others reported attempts.
VulnCheck's own reading is that finding more flaws gives defenders a chance to fix them before criminals get there. That only holds if defenders move first. A leak, a slow patch cycle or a server nobody remembers can close that window, however the flaw was found.
The Guardian's explainer on the flaws read as AI when run through Fíor, though its newer model said it reads like a human wrote it. All week, explainers have been the coverage most likely to read that way.
AI found these flaws after years in which nobody else did. The finding was the easy part. Whether it helps depends on the days, sometimes the hours, that follow, and those are still spent by people patching servers.
Try the browser extension at Fíor.