Narrative · ↗ rising

AI finds the flaw, but the patching can't keep up

All narratives · 17 supporting stories · 1 from Hungary

„AI has become a key tool for vulnerability discovery, and the pace of found bugs tests repair and publication capacity.”

Counter-narrative

According to the AWS and Zhipu cases, some results are unreliable due to false alarms and unverified vendor statements. The AWS criticism sees the verification burden and the trust gap as the main problems.

Carriers

OpenAI (GPT-6 Cyber, disclosure plan), Google (Chrome, Gemini Cyber), Anthropic (OSS security program), PHP developers, Wiz, OWASP OASIS, National Cybersecurity Institute

Analysis

According to the narrative, both attackers and defenders use AI to find faults, and cheaper detection disrupts the order of fixes and publication. The PHP case showed this can cause widespread outages: government websites went offline after publication. Labs present cyber models (GPT-6 Cyber, Gemini Cyber) and free OSS tests as proof of defensive capability, which is also a business interest. The weak point is credibility: false alerts arrive on the same channel as real hits. Reports say finding faults has become easier, but fixing them remains difficult. The burden falls on open-source maintainers.

Evidence: moderate — Supported by real events: the bugs fixed in Chrome 149–150,1072, PHP's emergency fix on October 21, and the delay of PostgreSQL 19 due to a finding by AI review 40. However, the hit counts of GPT-6 Cyber, Zhipu GLM-5.3 and several agents are vendor or one-sided claims with no external verification. There is no direct measurement of patching capacity being overloaded.

What's at stake: Whether the industrialization of vulnerability detection brings more security or leads to a collapse in repair capacity.

Narrative sub-threads

The narrative splits into 5 branches; a story may belong to several branches, and some may not appear in the main narrative's list.

↗ rising · evidence: moderate

Models and agents as bug hunters

Manufacturer models and security agents report vulnerabilities ranging from dozens to thousands in single announcements. Reports cover such hits on Firefox, Linux, Android, Snowflake's internal systems, and open-source libraries.

It shows the detection side: vendors and security firms report their own detection performance. Evidence is therefore largely self-reported, external verification is missing or disputed, and false alarms open a trust gap.

8 stories · 0 of them Hungarian ▲ at peak · evidence: moderate

Genuine findings burden maintainers

The volume of bugs found by AI-based debuggers is overwhelming open-source maintainers and delaying releases.

The issue is not detection but the capacity of the receiving side. The Linux kernel receives nearly 2,000 vulnerabilities per release, while PostgreSQL 19 is delayed due to 40 bugs found by an AI review. The bugs are real, yet the patching and release cycle suffers.

4 stories · 0 of them Hungarian → lasting · evidence: strong

Fake AI reports paralyze reward programs

Due to a flood of hallucinated, invalid AI-generated bug reports, projects and companies are suspending or charging for bug reporting channels.

The mechanism is noise: invalid reports pollute the CVE process and bug bounty programs. The response is suspending the channel (Google OSS VRP, until 2027) or charging a fee for submissions (Firedancer, 1 SOL).

6 stories · 0 of them Hungarian ▲ at peak · evidence: strong

Redesigning disclosure rules after PHP

Following the discovery by AI of two critical PHP vulnerabilities (PHP2Shell), European and American government and organizational websites went offline, and Hungary's National Cybersecurity Institute issued an alert. OpenAI subsequently outlined a five-step disclosure plan. In parallel, AI companies and professional organizations launched mass patching initiatives and accelerated maintainer channels.

This is a coordination and institutional thread. At its center is a specific crisis case (PHP2Shell, patch: October 21) and OpenAI's protocol in response. Alongside it is the broader institutional response: expedited maintainer channels (Anthropic), mass patching initiatives (OWASP OASIS) and coalitions (Chainguard Athena). The burden on individual projects is not a subject of the thread.

7 stories · 1 of them Hungarian → lasting · evidence: moderate

The unreliability of automated fixes

One study found that AI-generated vulnerability fixes only correctly address the bug in about one-quarter of cases (6 CVEs, 6,080 attempts). Veracode reports that 44% of AI coding tasks introduce risky vulnerabilities. Meanwhile, GitHub has made agent-based automatic fixing (Agentic Autofix) generally available.

It measures the repair side: after a bug is found, it examines whether the AI fix is clean and who is responsible if it is not. An example is the dispute between Wiz and GitHub over a Snowflake bug allegedly written by Copilot Autofix.

5 stories · 0 of them Hungarian

Sub-thread stories

Models and agents as bug hunters

Carriers: Google, OpenAI, Anthropic, Wiz

Aug 17, 2026Wiz's AI agent finds Snowflake vulnerability that GitHub Copilot missedsenior developerDo not assume the findings of AI code-review tools are complete; additional testing is needed.Aug 17, 2026Zhipu says its GLM-5.3 coding model developed cyber-offence skills faster than expected Aug 31, 2026Google unveils Gemini 3.8 Flash and a security-focused Cyber variant with stronger codingsenior developerAs a cheap, fast coding model, it can be compared with current tools.tech leadA measurement on your own codebase should decide whether switching is justified.Sep 14, 2026AWS AI vulnerability detection finds bugs, but false positives expose a trust gapsenior developerTo handle false alarms, validation of findings needs to be built into the process.Sep 24, 2026GitHub Security Lab automates fuzzing with an AI agent frameworkQA testerAutomated fuzzing can complement the testing strategy.senior developerAs an open framework, it can also be applied to your own libraries.Sep 28, 2026Open-source AI security agent used to find 24 Android vulnerabilitiessenior developerExpect AI-based searching to produce more vulnerability reports, and faster.Oct 26, 2026Claude reportedly proves safety properties in compiled code of 123 open-source librariessenior developerFor critical libraries, AI-assisted proofs are worth considering.Nov 2, 2026OpenAI's GPT-6 Cyber finds 81 Firefox and 948 Linux flawssenior developerMaintainers of open-source projects can expect a larger flood of bug reports.

Genuine findings burden maintainers

Carriers: Linux kernel maintainers, Linus Torvalds, PostgreSQL project, GNOME developers

Aug 31, 2026Linux kernel nears record 2,000 vulnerabilities per release as AI bug hunters flood maintainerssenior developerOpen-source maintainers are best served by high-quality, reproducible bug reports.Oct 5, 2026Torvalds and GNOME developers struggle with flood of AI bug reportssenior developerAs a maintainer, introduce reporting templates and a screening process for AI reports instead of banning them.Oct 16, 2026PostgreSQL 19 delayed as AI review finds 40 bugssenior developerOn a large project, run an AI review before release as a supplement.tech leadAllow for the possibility that AI review can also push back the release calendar.Oct 19, 2026AI code review finds bugs, delaying PostgreSQL 19senior developerTry AI review on critical codebases as an additional bug-finding layer.

Fake AI reports paralyze reward programs

Carriers: Google OSS VRP, curl, QEMU, Solana Firedancer

Aug 3, 2026AI slop pollutes the CVE pipeline with fake SQLite vulnerabilitiessenior developerOpen-source maintainers need a rule for filtering AI-generated security reports.Aug 10, 2026Open-source projects ban or restrict AI-generated code: OpenJDK, Rust, curlsenior developerRead a project's AI policy before contributing, because banned AI-generated code can lead to rejection or a ban from the project.tech leadCheck that the AI policies of the open-source dependencies you use are consistent with your own processes.Aug 24, 2026Open-source maintainers swamped by AI-generated bug reports and pull requestssenior developerIf you are a maintainer, introduce an AI-use policy and submission filtering; if you contribute, personally check an agent's output before submitting it.tech leadMake clear within the team that AI-generated bug reports to external projects may be filed only after human verification.Oct 3, 2026Google freezes open-source bug bounty program amid flood of invalid AI submissionssenior developerReproduce a bug by hand before reporting it; reports copied from AI damage the profession's credibility.Oct 5, 2026Google suspends open-source bug bounty programme after flood of AI-generated reportssenior developerAs an open-source maintainer, triaging incoming reports is likely to be a bigger burden, so it is worth setting up filtering rules.startup founderIf you run your own bug bounty programme, expect a flood of AI-generated submissions.Oct 27, 2026AI bug reports swamp maintainers as OpenAI offers advice and Firedancer sets a feesenior developerAs a maintainer, set rules on how reports must be formatted and substantiated.

Redesigning disclosure rules after PHP

Carriers: PHP developers, OpenAI, Anthropic, OWASP

Aug 31, 2026OWASP OASIS and Broadcom TrueSource target open-source vulnerabilities at scaleCTONew vendor options have appeared for enterprise open-source protection strategies.Sep 28, 2026Manifest joins Chainguard's Athena coalition to find open-source risk Oct 2, 2026AI used to uncover critical vulnerabilities in PHP, Hungarian outlet reports Oct 7, 2026Anthropic offers free security scans to open-source projects and launches long-term critical infrastructure programsenior developerAs an open-source maintainer, consider applying to the program to have your project scanned for free.CTOOpen-source dependency risk management should take into account the new AI-based scanning options.Oct 19, 2026Flood of AI-found bugs: OpenAI outlines a five-stage disclosure plansenior developerAs a maintainer, it is worth defining in advance how to handle a large number of machine-generated bug reports.Oct 21, 2026Websites go offline over AI-found critical PHP flaw; Hungary also issues alertCTOAn owner must be assigned for the fix, and it must be decided in advance which services to take temporarily offline if necessary.senior developerTime must be set aside to retest in-house PHP applications and dependencies after the fix.Oct 26, 2026Government websites go offline after critical AI-discovered PHP flawssenior developerFor PHP-dependent services, post-patch regressions need to be tested.

The unreliability of automated fixes

Carriers: GitHub, Veracode, Wiz

Google search interest

Hungary

Topic and search term	Weekly	Average
AI finds the flaw, but the patching can't keep upvulnerability		0.1
Models and agents as bug hunterssecurity vulnerability		1
Genuine findings burden maintainerssecurity patch	no measurable search	0
Fake AI reports paralyze reward programsai slop		1.3
Redesigning disclosure rules after PHPPHP vulnerability		0.7
The unreliability of automated fixescve		2.4

World

Topic and search term	Weekly	Average
AI finds the flaw, but the patching can't keep upvulnerability discovery		0
Models and agents as bug huntersai vulnerability scanner	no measurable search	0
Genuine findings burden maintainerssecurity patch		2.7
Fake AI reports paralyze reward programsai slop		4.1
Redesigning disclosure rules after PHPphp vulnerability		3
The unreliability of automated fixesautomated vulnerability fix	no measurable search	0

Google Trends relative search index over the period studied, weekly average. A narrative and its sub-threads appear in a single comparison: 100 is the group's most-searched day, and the figures can only be compared within the group. The search term was chosen by machine analysis; it measures how much the term is searched, not how widespread the narrative is.

Who is affected and how

senior developer: Do not accept AI fixes without verification. One study found that across six CVEs and 6,080 attempts, only about one in four fixes was clean. Fixes must be proven with regression tests.
CTO: The update cycle must be set to a faster pace. In the PHP2Shell case, government websites were forced offline after the emergency patch was released, making response time critical.

Hungary

In the period examined there is one case with a Hungarian angle: the National Cybersecurity Institute issued an alert over PHP flaws found by AI (2026-10-19-01). Beyond this, the domestic trace is slight.

Oct 21, 2026Websites go offline over AI-found critical PHP flaw; Hungary also issues alertCTOAn owner must be assigned for the fix, and it must be decided in advance which services to take temporarily offline if necessary.senior developerTime must be set aside to retest in-house PHP applications and dependencies after the fix.

Weekly trend

Supporting stories per week

Turning points

Oct 2, 2026AI used to uncover critical vulnerabilities in PHP, Hungarian outlet reportsCritical PHP vulnerabilities were discovered using AI, and according to the report title, the findings leaked. Thus, the outcome of the discovery has become an attacker risk.Oct 21, 2026Websites go offline over AI-found critical PHP flaw; Hungary also issues alertPHP bugs discovered by AI caused European and American government and organizational websites to go offline; the Hungarian National Cybersecurity Institute also issued an alert. The narrative thus shifted from the world of labs to critical infrastructure.Oct 19, 2026Flood of AI-found bugs: OpenAI outlines a five-stage disclosure planOpenAI outlined a five-step disclosure plan, and the debate shifted from detection to responsible coordination.

Supporting stories

Aug 3, 2026Three in four AI-generated vulnerability patches break something; Veracode measures 44%senior developerAn AI-supplied fix must be validated with tests and regression checks; the flaw disappearing is not enough.QA testerTargeted regression tests are needed around security fixes.tech leadIt is worth adding separate security gates for AI code in CI.Aug 3, 2026Google fixes 1,072 security vulnerabilities in Chrome 149 and 150, with AI-suggested patches Aug 13, 2026Bitcoin developers request early access to AI modelssenior developerIf you work on such a project, expect AI-based vulnerability discovery.Aug 17, 2026Wiz's AI agent finds Snowflake vulnerability that GitHub Copilot missedsenior developerDo not assume the findings of AI code-review tools are complete; additional testing is needed.Aug 17, 2026Zhipu says its GLM-5.3 coding model developed cyber-offence skills faster than expected Aug 31, 2026Google unveils Gemini 3.8 Flash and a security-focused Cyber variant with stronger codingsenior developerAs a cheap, fast coding model, it can be compared with current tools.tech leadA measurement on your own codebase should decide whether switching is justified.Aug 31, 2026OWASP OASIS and Broadcom TrueSource target open-source vulnerabilities at scaleCTONew vendor options have appeared for enterprise open-source protection strategies.Sep 14, 2026AWS AI vulnerability detection finds bugs, but false positives expose a trust gapsenior developerTo handle false alarms, validation of findings needs to be built into the process.Sep 28, 2026Open-source AI security agent used to find 24 Android vulnerabilitiessenior developerExpect AI-based searching to produce more vulnerability reports, and faster.Oct 2, 2026AI used to uncover critical vulnerabilities in PHP, Hungarian outlet reports Oct 7, 2026Anthropic offers free security scans to open-source projects and launches long-term critical infrastructure programsenior developerAs an open-source maintainer, consider applying to the program to have your project scanned for free.CTOOpen-source dependency risk management should take into account the new AI-based scanning options.Oct 16, 2026PostgreSQL 19 delayed as AI review finds 40 bugssenior developerOn a large project, run an AI review before release as a supplement.tech leadAllow for the possibility that AI review can also push back the release calendar.Oct 19, 2026Flood of AI-found bugs: OpenAI outlines a five-stage disclosure plansenior developerAs a maintainer, it is worth defining in advance how to handle a large number of machine-generated bug reports.Oct 21, 2026Websites go offline over AI-found critical PHP flaw; Hungary also issues alertCTOAn owner must be assigned for the fix, and it must be decided in advance which services to take temporarily offline if necessary.senior developerTime must be set aside to retest in-house PHP applications and dependencies after the fix.Oct 26, 2026Government websites go offline after critical AI-discovered PHP flawssenior developerFor PHP-dependent services, post-patch regressions need to be tested.Oct 26, 2026Claude reportedly proves safety properties in compiled code of 123 open-source librariessenior developerFor critical libraries, AI-assisted proofs are worth considering.Nov 2, 2026OpenAI's GPT-6 Cyber finds 81 Firefox and 948 Linux flawssenior developerMaintainers of open-source projects can expect a larger flood of bug reports.

Machine analysis based on story titles and summaries, with a verification pass. The source of the facts is the article linked at each story.