GTIG Report: Vulnerability Disclosure and Exploitation Trends in the AI Era

Google Threat Intelligence Group (GTIG) analyzed vulnerability disclosure and exploitation data from January 2025 to August 2026, concluding that AI is changing the speed and risk structure of vulnerability discovery and exploitation. Monthly vulnerability disclosures increased from 5,045 in January 2026 to 10,477 in July, reaching 10,740 in August; in-the-wild exploitation rose from a monthly average of 10.5 in 2025 to 18 in 2026, while zero-day exploitation only increased slightly from a monthly average of 8 to 11. High-risk vulnerability disclosures increased from 131 in January to 350 in August, a 167% increase, driven mainly by batch disclosures of TOTOLINK router firmware and Oracle quarterly patches and Linux kernel network driver announcements.