The security updates landing on your phone and laptop now carry more security fixes than ever, and artificial intelligence is a big reason why. AI tools are finding weaknesses in software faster than human researchers ever could.
The surge took off in April, when Anthropic announced Claude Mythos Preview, a model it says can find and exploit flaws on its own. Once a fix is released, the flaw it closes becomes public, and attackers can study it. In October, Microsoft fixed more flaws in a single month than in any previous full year. Finding flaws early is good news: each one fixed is one hackers can’t use. But a fix protects only the devices that install it. Those that don’t, from older phones to outdated PCs, are left exposed, and the same AI tools could one day help attackers find a way in. Google, OpenAI and Microsoft have their own tools. The systems that track flaws are straining too. Devices that skip updates stay exposed. So far, the flood of flaws has not become a wave of attacks. But the same AI tools could also help attackers, and evidence of attacks often surfaces months later. In India, many devices may miss these fixes altogether. The price doubles every consecutive year. Google no longer sends these versions its critical system security fixes.
Google’s Chrome browser has released nearly 14 times as many security fixes this year as in all of 2025. It gave access only to about 50 partner organisations, and says they found more than 10,000 serious flaws in the first month. Oracle, whose software runs many banks, airlines and hospitals, released 3,561 security fixes, against 1,379 in 2025. Apple’s latest Mac operating system macOS 27 Golden Gate, released in September, shipped with 204 fixes, its most ever for a single release. Flaws that the US cybersecurity agency CISA confirmed hackers had used rose from 245 in 2025 to 283 so far this year. That is about three for every 1,000 flaws reported. In September, about 41% of Windows desktop web traffic in India came from Windows 10, according to analytics firm StatCounter. Windows 10 now gets security fixes only to users who sign up for its extended update programme which costs nearly Rs 6000 for the first year. On phones, about one in five Android devices browsing the web runs Android 12 or older.
In April, the US National Institute of Standards and Technology stopped fully analysing older entries in its CVE database, moving about 29,000 into a “Not Scheduled” category.
AI Is Finding Software Flaws Faster Than The World Can Fix Them
Research group Epoch AI found that in June alone, reports of high-severity and critical flaws were more than three times the previous monthly record. How much of this is down to AI? No one knows precisely. Pirated software adds to the risk. The best way to protect yourself from cyberattacks is simple: turn on automatic updates, and check whether your devices still receive them. Don’t rely on unlicensed software.
More than 84,000 software flaws have been publicly listed in the global CVE (Common Vulnerability and Exposure) system so far this year, up from about 45,000 in all of 2025. Security firm VulnCheck counted 1,061 flaws credited to AI-assisted discovery in the first half of 2026 but counts vary widely depending on who is counting. The latest industry estimate, from software trade group BSA in 2016, found that 58% of software installed on Indian PCs was unlicensed. In a 2018 Microsoft test, 17 of 22 Windows PCs bought from Indian shops came loaded with unlicensed software.
Every flaw found needs a fix, and every fix needs installing. Between January and October, Google released 3,686 security fixes in Chrome’s computer updates, against 270 in all of 2025. Microsoft fixed 4,265 flaws that require users to install updates, up from 1,209 last year.
