AI Vulnerability Discovery Hits 35k CVEs in H1 2026 While Exploited Subset Stays at 495

AI systems like Anthropic’s Mythos models generated 26,153 vulnerability candidates in open-source code, yet upstream patches covered just 421. This volume surge, up 49% year-over-year per NVD data, outstrips manual triage capacity. CVSS scores alone fail to capture reachability, control effectiveness, or asset criticality, leaving defenders without actionable signals on the 116 zero-day exploits disclosed same-day. Automated pentesting covers only 32% of attack surfaces annually according to Omdia, constrained by missing exploits and air-gapped assets. The pattern shows disclosure velocity now exceeds safe live-testing windows, forcing reliance on static and simulated validation layers that still lack unified evidence trails across procurement and incident records. Integrated platforms combining exploitability checks, control validation, and agentic chaining close the loop, but current deployments remain fragmented. Without cross-referenced data from CISA KEV lists and vendor patch telemetry, organizations continue over-prioritizing non-exploitable findings while missing chained paths that bypass single controls. Next six months will test whether vendors embed these three validation modes into single workflows or maintain separate tool silos that perpetuate the coverage gap.