AI-driven software vulnerability exploitation trends

The landscape of software vulnerability exploitation is shifting due to the rapid acceleration of automated and AI-driven tools. Data from the first half of 2026 indicates that the mean time from vulnerability disclosure to exploitation has dropped significantly, falling from 21.5 days in 2025 to just 8 hours in 2026. This trend is driven by agentic pentesting methods designed to autonomously discover and validate attack paths.

Reports from FortiGuard Labs suggest that automated offensive tools have compressed the validation and exploitation window to between 24 and 48 hours, a sharp decline from the historical average of approximately one week. In Latin America, exploitation attempts rose by nearly 40 percent in 2025, reaching nearly 15,000 million attempts, as automated routines increasingly chain multiple flaws to create high-severity breaches.

Defensive strategies are evolving to meet these speeds. Gartner has introduced the Continuous Offensive Security Testing (COST) model to move beyond point-in-time assessments toward trigger-driven, risk-tiered testing. However, remediation remains difficult; while AI can discover complex bugs, current frontier models often refuse remediation prompts due to guardrails, and automated patching frequently risks breaking production code or missing secondary issues.