a graph showing the number of computer vulnerabilities by week since 1990, increasing exponentially in the last couple months.

This shows number of discovered and publicly revealed ones.

The vulnerabiliries were mostly there already, just waiting in secret.

LLM's are fast readers with pattern matching capabilities and few inhibitions to try things out. Interesting times ahead.

This is just spunge bob showing up the huge pile of trash all over.

In my 30 years carrier of sw eng there was not a single company i worked for that would take security seriosly enough. Not even the two banks I worked for, the security focus was higher there, but nowhere close to enough. Deadlines had to be met, shareholders had to be made happy. Security is the type of investment the better you do it the more invisible it looks and is easy for managers to put lower on the backlog.

The ocasional security researcher I had the privilidge to talk to or work with always had few vulnerabilities in pocket to report in case they dry up on the findings.

Good luck to the overworked understuffed teams in an average company.

CVEs are good. It means critical issues were found and are being fixed.

No CVEs is the more worrisome of the two.

There's something so awesome, about a corporate security researcher keeping vulnerabilities in pocket, to have something to report.

I love the sweet, sweet irony.

oh well, in that case i guess everything will be just fine. awesome!

Having seen the sheer volume of hallucinated or bogus reports and seeing that not every project is its own CNA...

What does the graph look like when you only count published and non-disputed CVEs? (My gut says it'll still look somewhat similar)

It's also important to know that some of these CVEs require super niche or unusual configuration to be exploited. This doesn't make them less valid, than elf that llms are good at is chaining exploits.

What it does do is make the defender's job significantly more difficult because how do you both stay up on all the latest vulnerabilities, but then also find valid patches without resorting to using vibe coding?

It's also worth pointing out that the fact there is a new breed of exploit discovery tools itself is creating a new focus on finding and fixing security exploits.

Many (perhaps the majority?) of these were not discovered by AI agents, but were found due to extra thorough testing due to the fear of security issues being found by AI agents.