Bug Discovery Rate Accelerates in AI Systems

3% of “critical” software security bugs, in all of recorded history, have been found in the last month.

The headline numbers

The short, stark arithmetic in the original post is simple and hard to ignore: discoveries made in a single month amount to 3% of every critical software vulnerability ever recorded. The same calculation, the author writes, produces a forward projection that would “find another ~100,000 bugs this year alone,” an increase that would add roughly “~26% more vulnerabilities to the all time total.” Those are not estimates framed as possibilities but presented as immediate, numerical consequences of recent discovery rates.

What the tally says about discovery pace

Putting the two figures together — 3% in one month and a projected ~100,000 by year’s end — yields a clear conclusion in the source material: discovery activity is accelerating, at a rate that would materially change the size of the historical vulnerability record within months. The post frames the shift with blunt language, asking, “Do you realize how fucking insane that is?” and closing with, “Yes. It is a new world out there.” Those lines capture a judgment built directly on the underlying arithmetic: the pace of finding high-severity bugs has, in the author’s account, moved from slow accretion to a surge with immediate statistical effect.

How this affects software inventories and vulnerability backlogs

A roughly 26% increase in the all-time vulnerability total is not an abstract statistic. For organizations that track inventories, telemetry, and patch backlogs, the projection implies a sudden and sizable rise in items requiring triage, verification, and remediation. Even without additional context about which products or components are implicated, the numbers alone imply a larger workload: more entries to classify, more CVE records to review, and more potential high-priority fixes to schedule into release cycles.

What this means for technologists and security teams

• Security operations and incident response teams will face a heavier triage burden as the volume of reported critical bugs expands. The source material’s projected pace implies both increased intake and the need for faster prioritization.
• Vulnerability management programs that rely on manual review will be strained; the arithmetic in the post suggests immediate pressure to automate parts of verification and patch-management workflows to keep up with discovery rates.

What this means for affected enterprises and procurement leaders

• Enterprises with large software footprints should expect the numbers reported to translate into more notifications from vendors, more patches to test, and more scheduling choices for maintenance windows. The source’s ~100,000 projection signals a spike in vendor-to-customer communications and operational decisions.
• Procurement and risk teams may need to factor a materially higher total vulnerability count into supplier risk assessments and service-level discussions, given the post’s claim that the all-time total could expand by about a quarter this year.

A narrow record, a broad implication

The original post layers a terse arithmetic claim with pointed commentary. It does not itemize which products, vendors, or discovery methods produced the spike; it instead leaves the reader with a simple numeric ledger: 3% now, ~100,000 more this year, ~26% added to the total. That compact set of figures is what drives the wider conclusion offered in the source — that the environment for vulnerability discovery has shifted fast enough to alter the historical record in a single year.

The numbers demand attention even absent additional detail. They imply an operational inflection point: if discovery continues at the pace cited, organizations and teams that track, fix, and defend against critical vulnerabilities will need to realign resources and expectations to match a larger, faster-moving queue of issues.

Original story: https://www.schneier.com/blog/archives/2026/11/ai-vulnerability-finding-2.html