AI’s Vulnerability Surge May Be More Manageable Than First Feared
A new report from Echo suggests that while AI is dramatically accelerating vulnerability discovery – leading to a 145% increase in CVE disclosures in two years – enterprises are not overwhelmed. The key is that many of these newly discovered vulnerabilities are not yet validated and that the biggest challenge isn't a lack of available fixes, but rather the difficulty of getting those fixes deployed efficiently due to resource constraints and complex deployment processes. Echo found that a significant portion of vulnerabilities stem from unnecessary dependencies, highlighting the need for organizations to reduce their attack surface by using less vulnerable software and streamlining their patching processes.
A new study from Echo reveals that the surge in vulnerability discovery driven by AI is not necessarily leading to a catastrophic security crisis for enterprises. The research, titled Mythos Readiness Report, indicates that while AI tools like Anthropic’s Claude Mythos are rapidly identifying vulnerabilities – with CVE disclosures increasing by 145% in two years – organizations are better positioned to handle the influx than previously assumed. However, the report emphasizes that a significant portion of these newly discovered vulnerabilities remain unvalidated, and the primary obstacle isn’t a lack of available fixes, but the complex and time-consuming process of deploying them.
Echo’s analysis of nearly 40,000 CVE life cycles across 250 open-source container projects shows a dramatic increase in vulnerability counts. Between January and June 2026, the number of known CVEs in Node base images surged 338%, from around 16,000 to 70,000, while for Python the numbers went from 17,500 to 45,000 in the same period. Mythos has fundamentally changed the economics of exploit development, making it possible for researchers and bad actors to develop a working exploit for a known vulnerability in less than one day and for under $2,000.
Despite the rapid increase in vulnerability identification, a substantial number of these vulnerabilities are not yet validated. Of the 23,019 potential vulnerabilities identified by Mythos, only 10% had been externally validated. Furthermore, Anthropic initially classified eight vulnerabilities as critical, but after independent review, only one retained that rating. This suggests that AI tools can generate a high volume of alerts, but accurately assessing their severity requires human expertise.
Echo found that a significant portion of vulnerabilities (nearly 40%) stemmed from unnecessary dependencies – software and tools not required in production environments. This highlights a critical area for improvement, as reducing the attack surface by minimizing dependencies can significantly decrease an organization’s overall risk.
“One of the biggest surprises was that being ready for Mythos is actually much more achievable than expected,” Eylam Milner, CTO and co-founder at Echo, tells Dark Reading. “Mythos is really good at finding real vulnerabilities, but it’s much less reliable at determining how serious those vulnerabilities actually are, which is a really important distinction for security teams trying to decide what requires their attention.”
Rather than completely rethinking everything they’re doing around vulnerability management, organizations should focus on infrastructure for quickly validating a larger number of vulnerabilities, understanding what matters and then remediating them efficiently. “A fix being available doesn’t mean it’s easy to deploy,” Milner adds. “Applying it can require upgrading dependencies, testing for compatibility and breaking changes, and moving the change through an organization’s normal development and release process.”
Ultimately, Echo recommends that organizations prioritize reducing their attack surface by using less vulnerable software and streamlining their patching processes, rather than simply trying to keep pace with the ever-increasing volume of newly discovered vulnerabilities.