For years, cybersecurity teams have operated with the assumption that time was at least a little bit on their side. A vulnerability would be discovered, assigned a CVE, analyzed, prioritized, and patched before attackers could exploit it widely. Human-in-the-loop processes worked well enough because defenders usually had some margin to respond.
That margin is disappearing. Google’s recent disclosure that it observed attackers using an AI-developed zero-day exploit in the wild marks a significant shift, especially coming on the heels of Anthropic’s bug-hunting advances. AI-assisted vulnerability discovery is accelerating how quickly weaknesses can be found, tested, and turned into working exploits.
But this is bigger than bug bounty programs. Modern applications are primarily built on open source components, frameworks, libraries, and transitive dependencies. As AI creates a wrinkle in the timeline between discovery and exploitation, every hidden dependency, outdated component, and delayed remediation decision becomes more consequential.
The old benchmark was how quickly an organization could patch after disclosure. The new benchmark is whether it can continuously understand and reduce risk before disclosure ever arrives.
Compressed Cycle Time Is a Supply Chain Problem
AI is moving so fast that manual intervention is virtually obsolete. This is dangerous in modern software supply chains where organisations depend on thousands of rapidly evolving open source packages.
Modern applications are assembled as much as they are written. A single application can depend on thousands of open source components, many of them pulled in indirectly through transitive dependencies. Across Java, JavaScript, Python and .NET registries that distribute open source, downloads reached 9.8tn in 2025. JavaScript alone accounted for nearly 8tn, up 65 percent in a year.
That complexity has always made vulnerability management difficult. AI raises the stakes because it compresses the time organizations have to identify where they are exposed and act on that information.
This mirrors the early days of open source adoption. Organizations moved quickly because the productivity gains were impossible to ignore, and governance followed later. The same pattern is now emerging with AI-assisted development.
The benefits are real, but so is the risk of scaling insecure code, outdated dependencies, and unverified components at machine speed. In fact, NIST in the U.S. recently announced that it can no longer keep up with the pace of CVE submissions and will only evaluate those that meet certain criteria for criticality.
The antidote is visibility. Security teams need to know what is in their software, where it came from, whether it is vulnerable or malicious, and what safer alternatives exist. Without that context, faster development simply means faster risk.
AI Changes the Economics of Exploitation
AI does not need to outperform human researchers to change cybersecurity. It only needs to reduce the cost and time required to discover and weaponize vulnerabilities.
That changes the economics of exploitation.
Attackers can now use agentic systems to automate parts of vulnerability discovery, correlate weaknesses across projects, and accelerate exploit development in ways that previously required significant expertise and time. Defenders, meanwhile, are still operating inside workflows built around manual prioritization, fragmented tooling, and patch cycles measured in days or weeks.
The asymmetry matters. Attackers can focus on a narrow objective. Security teams have to defend sprawling environments made up of applications, cloud infrastructure, containers, CI/CD pipelines, and thousands of dependencies — all while continuing to ship software.
This is why speed alone is no longer enough, and organizations cannot patch their way out of a problem that is operating at machine scale. They need systems capable of continuously identifying risk, enforcing policy automatically, and reducing exposure before vulnerabilities become active incidents.
And importantly, not all risk looks the same. Vulnerable open source components are fundamentally different from malicious packages intentionally designed to cause harm. Both require visibility, but they demand different defensive strategies. As AI accelerates both software development and exploit development, understanding that distinction becomes increasingly important.
Continuous Defense Has to Become the Baseline
The response to this shift cannot be to slow development down. Organizations are not going to abandon AI-assisted development any more than they abandoned open source or cloud computing. The productivity gains are simply too significant.
But speed without visibility creates risk at machine scale.
Organizations that succeed in this environment will be the ones that aggressively automate security, embed trust controls directly into software delivery pipelines, continuously verify software integrity, and reduce operational latency across the supply chain. Security can no longer rely on periodic reviews, manual inventories, or post-disclosure response cycles that were designed for a slower era of software development.
The industry has spent years optimizing how quickly software can be built and deployed. Now it needs to apply that same urgency to understanding what is being built, where it came from, and whether it can be trusted.
AI did not create software supply chain risk. It simply removed the illusion that organizations still had time to manage it manually.
