Frontier AI Broke the Vulnerability Math
Security Boulevard, Friday, October 16th, 2026
Exploitation overtook stolen credentials as the top breach vector, and AI discovery is flooding teams with more patches than they can apply.
Verizon's 2026 DBIR found that vulnerability exploitation became the leading initial access vector for the first time in 19 years, at 31% of breaches versus 13% for credential abuse, even before AI discovery reached scale.
Claude Mythos then found a 27-year-old OpenBSD bug and more than 23,000 potential flaws across 1,000 open source projects.
Linux disclosed 2,308 CVEs in the first half of 2026, FIRST forecasts about 66,000 CVEs this year, and median remediation time rose from 32 to 43 days.
Because most CVEs are never exploited, the author argues for prioritizing by real exploitation and exposure rather than trying to patch everything.