Interpreting the GTIG AI Vulnerability Trends Report: RCE accounts for 50% in publicly attributed samples

Google Threat Intelligence Group released "Vulnerability Discovery and Exploitation Trends in the AI Era" on September 30, 2026. The report states that exactly 50% of vulnerabilities discovered by AI lead to remote code execution (RCE), compared to 26% in the entire CVE ecosystem. The report's observation window is January 2025 to August 2026, tracking a total of 2,076 AI-related CVEs, of which more than 1,500 are from January to August 2026; disclosures increased from 5,045 in January 2026 to 10,477 in July, with a peak of 10,740 in August. GTIG states that its statistics rely on vendor public attribution and acknowledges that due to a lack of standardized metadata and vendors silently patching in production environments without requesting CVEs, public data significantly underestimates the number of vulnerabilities discovered by AI, but it does not specify the direction of the underestimation.