The rapid acceleration of vulnerability discovery driven by artificial intelligence has triggered widespread concern across the cybersecurity industry, but new data suggests enterprise organizations are far better prepared to handle the surge than commonly believed. Software supply chain security firm Echo analyzed nearly 40,000 CVE life cycles across 250 open source container projects, drawing on a year of its own platform telemetry, survey responses from more than 80 security leaders, and an independent analysis of Anthropic’s Claude Mythos. The resulting report, the Mythos Readiness Report, reveals that while AI is transforming vulnerability discovery and exploit development at machine speed, the key for enterprises lies not in panic but in their ability to quickly validate findings, prioritize risk, and deploy available fixes into production.
CVE Disclosures Surge 145% in Two Years as AI Accelerates Discovery
Monthly CVE disclosures rose 145% in two years, from 3,173 in June 2024 to 7,765 in June 2026, partly due to the expansion of the CVE program and increasingly because of AI-assisted vulnerability discovery. On an annual basis, CVE disclosures jumped from 30,949 in 2023 to 49,979 in 2025, and based on current trends, 2026 is on track to surpass even that number. Echo found the same pattern with container base images: between January and June 2026, known CVEs in Node base images surged 338%, from around 16,000 to 70,000, while Python base images went from 17,500 to 45,000 in the same period.
This acceleration is not merely a statistical curiosity. AI tools like Anthropic’s Claude Mythos have fundamentally shifted the economics of exploit development, enabling researchers and malicious actors to develop a working exploit for a known vulnerability in less than one day and for under $2,000. As Echo noted in its report, “Vulnerabilities are now being discovered at machine speed, while remediation remains largely manual. In essence AI has dramatically accelerated one side of the equation, but the other has yet to catch up.”
Validation Gap: Why Most AI-Discovered Vulnerabilities Are Overrated
Despite the alarming raw numbers, Echo uncovered reasons for measured optimism. The majority of vulnerabilities that AI tools uncover are not yet vetted and often prove less serious than initially assumed. Over the study period, Mythos discovered approximately 23,019 potential vulnerabilities, but fewer than 10% had been externally validated, or independently checked. Of the 27 vulnerabilities that Anthropic publicly disclosed, Mythos initially classified eight as critical severity. After independent review, only one retained that critical rating.
“One of the biggest surprises was that being ready for Mythos is actually much more achievable than expected,” said Eylam Milner, chief technology officer and co-founder of Echo. “Mythos is really good at finding real vulnerabilities, but it’s much less reliable at determining how serious those vulnerabilities actually are, which is a really important distinction for security teams trying to decide what requires their attention.”
This validation gap means enterprises do not need to completely rethink their vulnerability management programs. Instead, they should focus on infrastructure for quickly validating a larger number of findings, understanding what matters, and then remediating efficiently.
How Does an Enterprise Effectively Validate AI-Discovered Vulnerabilities?
Enterprises should establish a triage pipeline that separates raw AI output from independently verified findings. Automated scanning tools can flag potential issues, but human review or trusted third-party validation is essential to determine actual severity. Organizations that already have mature security operations can integrate AI-generated vulnerability data into existing workflows, applying prioritization based on exploitability, asset criticality, and business context. The key is to avoid reacting to every unvalidated alert and instead focus resources on the small fraction of vulnerabilities that are both real and exploitable.
Fix Availability Is High, but Deployment Remains the Bottleneck
Echo found that 89% of the vulnerabilities examined already had a fix available, with even higher rates for critical and high-severity flaws. Yet nearly 40% of fixable vulnerabilities remained unresolved for more than six months. This disconnect reveals that the core problem is not the absence of patches but the difficulty of getting them into production.
“A fix being available doesn’t mean it’s easy to deploy,” Milner explained. “Applying it can require upgrading dependencies, testing for compatibility and breaking changes, and moving the change through an organization’s normal development and release process.” When security teams must apply this process across thousands of vulnerabilities, remediation becomes a massive prioritization-and-resource problem. Engineering teams have limited time, and security fixes compete with product work and other priorities, leaving vulnerabilities to sit in backlogs for months.
Echo’s recommendation is to remove as much manual work as possible by continuously delivering patched software rather than relying on engineering teams to chase and deploy each fix individually.
Self-Inflicted Exposures: Unnecessary Attack Surfaces
Another significant finding is that many organizations are making the problem worse on their own. A striking 56% of container vulnerabilities stemmed from packages, utilities, development tools, and other software not needed in production. These self-inflicted exposures inflate the attack surface and increase the noise that security teams must filter.
“Before worrying about how to keep up with every new vulnerability AI finds, organizations should focus on reducing the attack surface they already have,” Milner advised. “Build with less vulnerable software to begin with, remove the dependencies they don’t need, and focus on getting available fixes into production much faster.”
This practical advice directly addresses the root causes of vulnerability fatigue. By cutting unnecessary dependencies, enterprises can dramatically reduce the number of alerts they need to process, making the AI-driven surge far more manageable.
Infrastructure Overhaul Not Required for Most Enterprises
The data suggests that enterprise organizations do not need a complete security architecture rebuild to cope with the AI-driven vulnerability surge. What they need is a sharper focus on validation, prioritization, and automated remediation pipelines. The Mythos Readiness Report indicates that even organizations with mature security postures often overlook basic hygiene, such as removing unused dependencies or automating patch deployment.
The broader implication is that the security industry may be overestimating the threat posed by AI-discovered vulnerabilities while underestimating the value of fundamental operational improvements. Enterprises that invest in continuous patching, rigorous validation, and attack surface reduction will be well-positioned to manage not only the current wave of AIaaaa-disclosed flaws but also future accelerations.
Echo’s findings serve as a counterweight to the narrative of inevitable overwhelm. The vulnerability surge is real, but it is not unmanageable. The enterprises that thrive will be those that treat AI not as an existential threat to their security programs but as a forcing function to eliminate inefficiencies they have tolerated for too long.
