AI Vulnerability Discovery Is Accelerating but Patching Is the Real Challenge

Anthropic’s decision to expand Project Glasswing to 150 organisations across critical infrastructure sectors arrives with a striking statistic. According to the company, participating organisations have already identified more than 10,000 high- or critical-severity vulnerabilities using its AI-assisted cyber capabilities.

The initiative now extends across more than 15 countries and includes organisations operating within power, water, healthcare, communications, and hardware sectors. Many are vendors and maintainers responsible for software relied upon by governments, enterprises and critical infrastructure operators worldwide.

The number itself is notable. The more significant question concerns what happens after those vulnerabilities are found.

For decades, vulnerability management has largely been constrained by the difficulty of discovering flaws across increasingly complex software environments. Advanced AI systems are beginning to change that equation. The challenge emerging beneath the surface is whether organisations have the operational capacity to absorb, prioritise, and remediate findings at the same pace.

Cybersecurity has long been a race between attackers and defenders. Increasingly, it may also become a race between machine-speed discovery and human-speed remediation.

AI Vulnerability Discovery Outpaces Patching

The promise of AI-assisted security has often centred on visibility. Automated code review, vulnerability discovery, threat modelling, and penetration testing all benefit from systems capable of analysing software and infrastructure at a scale that would be difficult for human teams to replicate.

Projects such as Glasswing demonstrate how quickly that capability is developing.

For many organisations, however, discovering vulnerabilities is only the beginning of a much longer process. Findings still need to be validated, prioritised, tested, approved, and deployed safely into production environments.

Jim Sherlock, Vice President of AI & Cybersecurity R&D at ProCircular, believes the industry is entering a new phase.

“Finding bugs stopped being the hard part.”

The operational challenge now sits further downstream.

“This expansion is Anthropic quietly admitting the hard part is now patching and deploying at scale.”

The Patch Backlog Problem

The imbalance between discovery and remediation is particularly visible in large enterprises and critical infrastructure environments.

A newly identified vulnerability does not automatically become a patch. Security teams must assess risk, understand operational dependencies and determine whether remediation could introduce disruption elsewhere.

That process becomes more difficult when vulnerability volumes increase dramatically.

Sherlock described the risk bluntly:

“Patch pipelines that are not able to handle the incoming flood of advisories and vulnerabilities will simply turn into a giant backlog full of good intentions.”

The concern is not that organisations will know less about their exposure. The concern is that they may know more than ever before while remaining constrained by the same operational bottlenecks.

Critical Infrastructure and Patch Constraints

Glasswing’s expansion includes organisations across sectors such as power, water, healthcare, communications, and hardware manufacturing.

These environments often operate under very different conditions than conventional enterprise IT.

Many systems cannot simply be patched immediately. Maintenance windows may be limited, operational downtime may carry significant consequences, and infrastructure may rely on legacy systems that are difficult to update safely.

Joe Saunders, Founder and CEO of RunSafe Security, argued that the implications extend beyond vulnerability discovery itself.

“The expansion of Glasswing gives more essential sectors a chance to prepare for the next phase of cybersecurity, where finding vulnerabilities is faster and reducing real-world risk is what counts.”

That distinction is becoming increasingly important. Discovery creates awareness. Resilience depends on what happens next.

AI Speeds Up Exploitation

AI adoption is not limited to defenders.

Anthropic argued that Mythos Preview represents part of a broader trend rather than an isolated capability. The company has warned that within six to 12 months, many AI providers may possess systems with similar cyber capabilities, potentially without equivalent safeguards designed to prevent misuse.

If vulnerability discovery becomes widely accessible, the volume and speed of security research could increase significantly. The same conditions could also lower barriers for malicious actors seeking to identify and exploit weaknesses at scale.

Flashpoint researchers noted that AI has the potential to “significantly compress the time between vulnerability discovery and exploitation.” The company also reports observing a 1,500% increase in illicit AI-related discussions over a single month.

The practical implication is straightforward. If attackers can identify, adapt, and weaponise vulnerabilities more quickly, the time available for remediation narrows.

Historically, organisations often benefited from a period between vulnerability disclosure and active exploitation. AI-assisted discovery has the potential to shorten that window considerably.

AI Security Governance as Infrastructure

The conversation around AI security often focuses on capability: which models can identify the most vulnerabilities or detect the most threats.

Enterprise leaders increasingly face a different set of questions.

How quickly can findings be operationalised? Which vulnerabilities genuinely require action? How are remediation decisions prioritised? What visibility exists across patching workflows?

John Carberry of Xcape, summarised the challenge succinctly:

“The enterprise challenge pivots entirely from flaw discovery to human patching capacity.”

This introduces a broader governance dimension. As AI systems become more effective at surfacing risk, organisations may need stronger remediation processes, clearer ownership models, and more mature operational controls to convert insight into action.

Cyber Resilience in the AI Era

Anthropic’s announcement is ultimately less about one AI system and more about what it reveals about the direction of cybersecurity.

For years, defenders struggled to find vulnerabilities quickly enough. Today, AI is beginning to remove some of those constraints.

The pressure is moving elsewhere.

Cyber resilience increasingly depends on whether organisations can respond, prioritise, and remediate at a pace that matches machine-assisted discovery. The organisations that benefit most from AI-driven security may not be those that find the most vulnerabilities, but those that can act on them before attackers do.