A Vulnerability Is Not an Exposure

In early October 2024 Google disclosed that its autonomous AI system, Big Sleep, identified a memory‑safety defect in SQLite and that the flaw was patched the same day, before any public release. Since November 2025 Anthropic’s telemetry shows 2,300 newly disclosed vulnerabilities across 392 open‑source projects, yet only 421 have been corrected upstream, illustrating a widening gap between discovery and remediation. The gap widens further after Google’s Threat Intelligence Group reported in May 2026 a zero‑day that had been weaponised with AI assistance, confirming that adversaries can leverage the same automated tools to move from discovery to exploitation almost instantly.

These data points signal a shift from manual, human‑driven bug‑bounty programs to mass, AI‑powered vulnerability hunting. Companies that build large language models or reinforcement‑learning agents—Google, Anthropic, OpenAI—are inadvertently creating dual‑use technology that accelerates both defensive discovery and offensive weaponisation. Traditional security workflows, which rely on periodic patch cycles and manual verification, cannot keep pace with the velocity of AI‑generated exploits. Moreover, the article’s distinction between a “vulnerable condition” and an “exposure” forces a rethink of risk metrics: a flaw becomes a true exposure only when a functional exploit exists for the specific version and configuration an organization runs.

Practically, enterprises must treat exposure as a binary, time‑stamped state and embed continuous revalidation into their change‑management pipelines. Telemetry that flags configuration drift, automated exploit‑validation sandboxes, and real‑time threat‑intel feeds become essential to avoid stale “fixed” entries that no longer reflect reality. Controls such as WAFs or MFA can reduce the chance of exploitation but do not eliminate the underlying condition, meaning they must be paired with rapid patch deployment. Security teams should also adopt the proposed ledger schema—recording feasibility, observation, and likelihood dates—to differentiate between a known exploit, observed attacks, and probabilistic risk. Watching for AI‑generated exploit code in underground forums and monitoring the speed at which vendors release patches will be critical indicators of emerging threat pressure.