Autonomous AI agents turned disclosed vulnerabilities into verified working exploits for a median of $2.83 and 11 minutes each. The vulnerabilities they exploited most easily are the ones today’s risk metrics tell defenders to ignore.

New free AI tools enable organizations to evaluate exploitability and exposure through the lens of an AI attacker

NEW YORK, July 21, 2026 /PRNewswire/ — Quantro Security, Inc. today published its 2026 report, The Economics of Vulnerability Exploitation with AI. The study is a large-scale, reproducible measurement of the cost and time required for autonomous AI agents, powered by Quantro’s Exploit Harness, to turn a disclosed vulnerability into a verified proof-of-concept (PoC) exploit. The research was conducted by Vulnerability Research Labs (VRL), a research unit of Quantro Security, Inc., in partnership with Loginsoft.

Key Findings

The core finding is direct: AI-driven vulnerability exploitation has become cheap and fast enough to collapse the economic barrier that has quietly protected the enterprise vulnerability landscape for three decades.

The Death of Defensive Scarcity

The Quantro Exploit Harness is an autonomous system of AI agents that ingests a disclosed vulnerability, reasons its way to a working exploit, and verifies execution with no human intervention.

When tested across a dataset of 3,029 disclosed CVEs, the AI agents successfully developed a verified, working exploit for 2,183 of them (72%). The operational cost? A median of just $2.83 and a median time of 11 minutes per vulnerability. By contrast, a skilled human security researcher typically requires days or weeks of dedicated labor to achieve the same result. To ensure integrity, analysts at Loginsoft independently verified the report’s methodology and findings, building upon the company’s contribution of core vulnerability intelligence and enrichment for the study.

“For thirty years, the true defense for most vulnerabilities was economic scarcity,” said Mehul Revankar, Chief Product Officer at Quantro Security. “Writing a reliable exploit required highly skilled human talent, meaning only a fraction of discoverable flaws were ever weaponized. Defenders built their entire patching and prioritization strategies around that constraint. Our data shows that the bottleneck is officially gone. When exploitation costs the price of a cup of coffee and takes less than a quarter-hour, ‘unlikely to be exploited’ no longer means safe.”

Key Findings at a Glance

72% Success Rate: AI agent produced a verified exploit for 2,183 of the 3,029 CVEs analyzed.
$2.83 Median Cost: the compute cost to generate a verified exploit PoC
11-Minute Median Time to Exploit: from vulnerability ingestion to a working PoC exploit.
308K Tokens: the median token volume to build and verify a single exploit PoC.
14-Minute Remediation: the time for the AI to generate a corresponding remediation.

Why Traditional Defenses are Obsolete in the face of AI-Native Cyber Offense

The report’s most alarming revelation is not just that AI can exploit vulnerabilities, but which vulnerabilities it targets.

A staggering 73% of the AI-exploitable CVEs carry an Exploit Prediction Scoring System (EPSS) score below 0.25, the exact threshold where most enterprise vulnerability management programs instruct teams to deprioritize patching. Furthermore, 1,933 (89%) of these AI-exploitable flaws are completely absent from the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog.

In short: the flaws that autonomous agents can trivially weaponize sit overwhelmingly within the population of bugs that defenders have been trained to ignore.

“EPSS and the CISA KEV catalog aren’t broken; they are simply answering a human question: ‘Will a human attacker take the time to exploit this?’” explained Sasan Padidar, CEO of Quantro Security. “But in 2026, the question defenders must ask is: ‘Can an AI agent exploit this vulnerability automatically?’ AI-exploitability must become a first-class, standalone prioritization signal. Relying on legacy human-centric metrics is leaving a massive side door wide open to automated AI-driven exploitation.”

“AI-native offensive tools are transforming exploit research, and the results get further enhanced when paired with best-in-class vulnerability intelligence. We are proud to partner with Quantro Security, leveraging their state-of-the-art exploit harness to power this cutting-edge research,” said Hari Charan, Head of Research, Loginsoft.

Arming the Cyber Defense Teams: Free Tools Released

To help organizations adapt to this asymmetric shift, VRL is releasing two free enterprise-grade tools alongside the report:

AI-XI (AI Exploitability Index): A tool allowing defenders to submit any CVE to an autonomous agent. The agent assesses the flaw’s susceptibility to AI weaponization and returns a score from 1 (easy) to 5 (hard), alongside an estimated time-and-cost footprint. And it uses the same exploit harness used by this research.
AI-Recon (AI-Native Exposure Scanner): A defensive scanner that maps an organization’s external attack surface through the lens of an AI adversary. It enumerates exposed services, packages, and versions, and directly flags where the Labs’ dataset of safe, verified AI exploits matches the organization’s live infrastructure.

Both tools are available now:

https://vulnerabilityresearchlabs.ai/ai-xi/
https://vulnerabilityresearchlabs.ai/ai-recon/

To learn more, join the webinar:

https://quantro.security/events/economics-of-vulnerability-exploitation-with-ai/

The full methodology and the per-CVE dataset are public for review:

Methodology: https://vulnerabilityresearchlabs.ai/methodology/
Data Explorer: https://vulnerabilityresearchlabs.ai/data-explorer/

About Quantro Security, Inc. Quantro Security is an AI-native cybersecurity company headquartered in New York, NY. Founded by industry veterans from CrowdStrike, Tenable, and Qualys, Quantro Security is dedicated to automating enterprise risk management and defensive engineering through advanced agentic AI. Learn more at quantro.security.

Media Contact: Quantro Security Press Team [email protected]