Have We Seen an Acceleration in Discoveries?

What it is

A METR note (August 2026) that plots public discovery series in vulnerabilities, mathematics and algorithmic optimization, looking for a slope change after a chosen breakpoint of January 2026. Its conclusion is that vulnerability discovery accelerated sharply, math somewhat, and optimization not clearly. The data collection and analysis were done by agents. METR says it audited them but expects remaining mistakes.

What the vulnerability data shows

The useful part for a security reader is how much of each rise is credited to AI, which varies widely by project:

• cURL: 9 CVEs in 2025, 36 through 24 June 2026. 15 of the 36 (42%) are AI-marked. Low severity fell from 7 of 9 in 2025 to 22 of 36, and AI-marked findings skew Low (12 of 15, against 10 of 21 for the rest).
• OpenSSL: 6 CVEs in 2025, 39 through 5 August 2026. 18 are corroborated AI discoveries and 9 more are AI-affiliated with the method unverified.
• Firefox: 210 CVEs in 2025, 342 through 4 August 2026. Only 37 (11%) are AI-marked.
• Microsoft: 1,243 in 2025, 1,927 through 11 August 2026, about 2.5 times the 2025 annualized rate. Only 26 (1.3%) carry an AI marker. Microsoft wrote in July 2026 that customers will see more security updates per release as AI helps defenders find issues.
• Aggregates: by early August 2026 the NVD count already equalled its 2025 total, and OSV already exceeded its 2025 count.

Higher-severity categories show less acceleration than lower ones, though still some.

Exploitation is not keeping pace

CISA KEV is on track to exceed its 2025 total, but growth is clearly below CVE growth. VulnCheck's 1H 2026 report says KEVs rose 10% over the prior six months while CVE volume rose 45%, so the KEV-to-CVE ratio dropped. VulnCheck notes that exploitation often follows disclosure by months or years, so it is too early to say whether exploitation will follow the CVE trend.

Math and optimization, briefly

• Math: arXiv combinatorics (math.CO) went from 377 submissions in January 2026 to 743 in July (2025 monthly average: 368). Three problems from major lists were solved with AI in 2026: the Jacobian conjecture counterexample (Smale's list), Green's Problem 44, and the sofic half of Green's Problem 100. METR calls this weak evidence.
• Optimization: nanoGPT, CIFAR-10, Hutter, Gurobi, MIPLIB, Stockfish and the matrix-multiplication exponent show no slope change comparable to the other two domains. METR calls this a puzzle given the January 2026 results from Yuksekgonul et al.

Caveats

• Only public discoveries are counted. METR considers undisclosed lab-internal discoveries plausible, especially for algorithmic efficiency.
• CVE dates reflect fix and disclosure, not discovery. Microsoft CVEs are batched by Patch Tuesday.
• Rising CVE counts may reflect heavy spending on AI-driven or conventional discovery rather than a change in how easily bugs are found. METR lists this as one candidate explanation among several and does not resolve it.
• The Erdős problem dates are imputed from paper years, against the site maintainer's warning, so that series is very weak evidence.
• The note says nothing on patch burden, triage cost or defensive actions. It does not tell an engineer what to do.