Clarion Street

The End of Hidden Vulnerabilities: AI Broke Discovery, Not Remediation

·9 min read

On the evening of July 29, 2026, a public proof-of-concept exploit for a critical Ruby on Rails vulnerability landed on GitHub. The vulnerability, CVE-2026-66066, is an arbitrary-file-read and possible remote code execution bug in ActiveStorage’s variant processing, scored 9.5 out of 10. Rietta, the Atlanta consultancy that runs Rails applications for HIPAA-covered clients and state agencies, was still deploying its own patch when that proof of concept went public. It finished at 11:09 PM. At 7:10 the next morning, one of its state-government clients logged an exploit attempt using the same malformed-BMP technique as that first public proof of concept.

That is eight hours and one minute after the patch. The proof of concept shipped before Rietta had finished applying the fix to its own clients, and the attack followed the same morning. Rietta is careful about what this proves. The timing does not confirm the attacker used that specific proof of concept, and Rapid7 reported no in-the-wild exploitation as of July 30. The correlation is the point, though. A vulnerability moved from patch to working exploit inside a business day, and the coordinated-disclosure window did nothing to slow it down.

Discovery sped up; the fix didn’t

For the past two years, the left half of the vulnerability lifecycle has been industrialized. Large language models can now do a lot of the bug-hunting pipeline: read source, generate inputs, write exploit code, draft the report. Aaron Portnoy, co-founder of Pwn2Own and now CPO at Mindgard, put it to Dark Reading plainly: “vulnerabilities are losing a place to hide,” because “AI doesn’t sleep and can find vulnerabilities at scale.”

The right half of the lifecycle has not changed. Triage, validation, disclosure, patching, and deployment still run on human clock time. Christopher Robinson, chief security architect at the OpenSSF, writes that discovery was never the bottleneck; fixing was. Discovery is now measured in hours. Remediation is still measured in weeks and months.

The platform numbers make the discovery side concrete. HackerOne’s report volume roughly doubled year over year. Trend Micro’s Zero Day Initiative saw its submission rate up 450% year over year in April 2026 before it moderated. Bugcrowd saw a three-week spike of more than 300% that has settled to roughly double its historical volume. And the reports pile up faster than anyone can fix them. HackerOne’s CEO Kara Sprague says critical vulnerabilities sitting in backlogs rose 30x over twelve months, even while mean time to remediation improved 50%.

The money broke before the defense

The mismatch hit the funding before it hit the defense. On March 27, 2026, HackerOne paused new submissions to its Internet Bug Bounty program, citing a “substantively shifted” balance between findings and remediation capacity. Node.js then paused its own bounty for lack of budget. curl’s Daniel Stenberg ended curl’s seven-year bounty program back in January, after AI-generated reports drove the confirmed-vulnerability rate from above 15% to below 5%.

That last number matters more than the pauses. A large share of the surge is noise, not signal. The platforms are drowning in volume where much of it is AI slop rather than newly exposed flaws, and they are fighting AI with AI on triage because that is the only way the numbers work.

Prices are compressing in the middle of the market. Dustin Childs of the Zero Day Initiative says the $2,000 to $50,000 bug is going to become very scarce, or the price is going to get pressed down. A macOS TCC bypass went from about $30,500 to about $5,000. Bugcrowd’s CEO Dave Gerry calls hunting a volume game, and says 82% of researchers now use AI.

It is not all collapse. HackerOne’s total payouts still rose 25% in the first half, and the number of researchers earning more than $100,000 rose 25%. The top of the market is fine while the middle reprices toward volume. Both things are true at once.

AI joined the attackers

This is where the subject overlaps what I have written about before. Booz Allen’s Cyber Weapon Index tested 18 leading US and Chinese models against a production-grade enterprise network. One of them, Anthropic’s Claude Mythos, completed the full kill chain autonomously. Four reached full domain control, and all but one penetrated the network. Booz Allen projects most models reaching that capability within about six months, which is a vendor assessment rather than a measurement.

The UK AI Security Institute reached a more careful version of the same finding. Mythos and OpenAI’s GPT-5.5 are the first two models to complete an end-to-end attack chain in its controlled CTF evaluations, and both succeeded in fewer than half their attempts. The models can do it. They are not yet reliable at it.

I have written about the AI-as-attacker thread in more detail, and about the wave of CVEs in agentic infrastructure itself. The relevant point here is narrower: the same capability that floods bug bounty programs also reads the patch diff the day it ships. Nico Waisman, CISO at XBOW, notes that today’s models are extremely noisy, and noise means early detection. That is a real brake on the near-term threat, and it cuts against the doom framing.

The disclosure clock stopped working

The Rails incident is the cleanest demonstration of the disclosure problem. The advisory withheld the exploit chain and promised full detail “no later than” August 28. That embargo was functionally meaningless from the moment the patch shipped, because the patch itself was a public code diff and was never embargoed. Researchers reverse-engineered the fix and published proof-of-concept code within a day, so Rails published its own forensic tooling on July 30, weeks ahead of the stated date.

André Baptista of Ethiack, one of the CVE’s discoverers, put it plainly: “We have been holding back technical details in multiple cases to give defenders more time, but things are happening too fast.”

The coordinated-disclosure grace period used to be the thing that gave vendors a head start. Now it is shorter than a business day. Rietta’s conclusion is the operational rule: patch on the fix, not on the writeup.

What a response looks like

The response is forming, and it is mostly boring. The UK NCSC tells organizations to prepare for a “vulnerability patch wave” and a forced correction of decades of technical debt. Its recommendations are automatic updates where possible, hot-patching, risk-prioritized triage using something like SSVC, and long-term memory-safety and containment work like CHERI.

Three of those deserve to be stated as operational requirements rather than best practice.

First, patch velocity is a survival metric now, not a hygiene metric. “Update by default” plus hot-patching is the baseline, not the aspiration.

Second, the fix has to be funded and industrialized the way the find was. HackerOne and Node.js pausing their bounties is the canary. We optimized the wrong end of the pipeline, and the correction is not to find fewer bugs but to fix them faster. IBM’s Cost of a Data Breach 2026 puts a number on the imbalance: one in four malicious breaches last year was AI-enabled, up 56% year over year, and those breaches averaged $6 million, about a million above the overall average. Only 18% of organizations apply AI agents to vulnerability management, while more than half use them for threat detection.

Third, triage has to be AI-assisted or it cannot keep up. When most of what comes in is slop, raw volume is not signal, and the only way to stay current is to let a model do the first pass.

There is also a coordination layer missing. Robinson’s argument is that what is absent is infrastructure for validation, routing, and synchronized disclosure. Projects like Akrites, Valkey’s provenance guard, and Trail of Bits’ Buttercup, the AIxCC winner, are early attempts at it, and the EU Cyber Resilience Act’s disclosure deadlines are converging with AI discovery from the other direction.

The caveats

Several of them keep this from being a clean apocalypse story. Most of the “six months to parity” claims are projections, not measurements. In the AISI’s own evals, the frontier models completed the chain in fewer than half their attempts. A large share of the report surge is slop, not signal. The bounty economy is bifurcating, not collapsing; the top of the market still pays. And the Rails case is one firm’s client and one proof of concept, with correlation rather than proven causation.

I also do not want to overstate stealth. Waisman’s point about noise stands. A defense running at human speed against an attack running at machine speed loses on arithmetic alone, but a machine-speed attack that is also loud is one you can see coming.

One adjacent development is worth a sentence and no more. OWASP released its Agentic Skills Top 10 in August 2026, with malicious skills, supply-chain compromise, and overprivileged skills as the top three risks. That is a different problem from vulnerability discovery; it is the new AI-supply-chain attack surface, and I have written about the skills-attack-surface concern separately. It belongs here only as a reminder that the discovery-versus-remediation mismatch is not the only place AI is stretching the old security assumptions.

The story I take from this is not that AI finds everything. It is that the two halves of the vulnerability lifecycle now run at different speeds, and the gap between them is where the risk lives. Discovery got compressed to hours while the fix stayed on human time, so the race is no longer find-versus-fix. It is fix-versus-exploit, and right now exploit wins by hours.

Sources

  1. AI Will End the Era of Hidden Vulnerabilities. Are Vendors Ready? — Dark Reading
  2. Companies Have 6 Months to Prepare for Automated Attacks — Dark Reading
  3. Government Rails Site Hit Hours After CVE Patch — Hacker News
  4. Government Rails Site Hit Hours After CVE Patch — Rietta
  5. Booz Allen Cyber Weapon Index — Booz Allen
  6. The Vulnpocalypse Is Repricing the Bug Bounty Economy — Dark Reading
  7. OWASP Flags Top AI Skill Risks in New Security Blueprint — Dark Reading
  8. Our evaluation of OpenAI’s GPT-5.5 cyber capabilities — UK AI Security Institute
  9. The Agentic AI threat cluster — Tenable
  10. Preparing for a vulnerability patch wave — UK NCSC
  11. The Vulnerability Gap: Why Discovery Is Outrunning Repair — Dark Reading
  12. KindaRails2Shell: CVE-2026-66066 — Rapid7
  13. AI-Led Remediation Crisis Prompts HackerOne to Pause Bug Bounties — Dark Reading