# The Vulnerability Disclosure Pipeline Is Choking — And AI Just Turned Up the Pressure
Somewhere in the bug tracker of a mid-sized software vendor, there are 300 unreviewed security reports. Half arrived in the last six weeks. Most are legitimate. Some are critical. And the two engineers responsible for triage are already three months behind.
This is not a hypothetical. It is the operational reality that a growing number of vendors describe privately, and that the numbers are beginning to confirm publicly. The CVE program processed over 40,000 vulnerabilities in 2024 — a record — and the National Vulnerability Database spent most of that year failing to keep pace with its own enrichment backlog. Now, as AI-assisted code analysis tools move from research labs into everyday security workflows, the volume problem is about to get structurally worse.
The era of hidden vulnerabilities is ending. That sounds like good news. It isn't — not yet, not the way we're set up.
## How AI Broke the Math on Bug Discovery
Manual code auditing is slow, expensive, and deeply dependent on the specific expertise of whoever is holding the pen. A skilled analyst might review tens of thousands of lines in a week. A well-configured AI tool — running semantic analysis, fuzzing harnesses, or pattern-matching against known vulnerability classes — can cover orders of magnitude more surface area in the same time.
Google's OSS-Fuzz project has been automating fuzzing for open-source software since 2016 and has found over 10,000 vulnerabilities. Add modern LLM-assisted code review on top of fuzzing, and the discovery rate accelerates further. Tools that security researchers were using experimentally eighteen months ago are now commercially packaged, accessible to anyone with a budget, and increasingly integrated into CI/CD pipelines.
The bugs were always there. AI is just making them findable at a pace that humans were never built to process.
## The Disclosure Pipeline Was Already a Fiction
Coordinated vulnerability disclosure sounds elegant in policy documents: researcher finds bug, notifies vendor in private, vendor patches, coordinated public release. In practice, the process has always been messier — but it scaled well enough when researchers were individual humans operating under conference deadlines.
That fiction is harder to maintain when a single researcher with the right toolset can generate dozens of valid reports per week. Vendors with no dedicated security response function — which describes the majority of commercial software companies — have no realistic path to processing that volume responsibly. Reports get lost. Patches get delayed. Researchers, frustrated by non-response, go public earlier. Vendors, blindsided, push incomplete fixes.
The bottleneck isn't bad faith. It's capacity. And the industry has never seriously invested in building the intake infrastructure to match the theoretical ideals of responsible disclosure.
## Secure by Design as a Marketing Phrase
There's been a lot of rhetoric from vendors and government agencies about "secure by design" software over the past two years. CISA has made it a centerpiece of its messaging. Vendors have signed pledges. The phrase appears in press releases with some regularity.
What it rarely means in practice is that vendors have actually audited their existing codebases for the classes of vulnerabilities that AI tools now find routinely: memory corruption, integer overflows, path traversal, injection flaws baked into legacy APIs. Signing a secure-by-design pledge is not the same as running your ten-year-old codebase through a semantic analyzer and fixing what it finds.
AI is doing the auditing now, at scale, whether vendors are ready or not. The question is who is doing it first — the researcher filing a report, or the threat actor who never will.
## The Attacker Symmetry Problem
Any honest framing of this issue has to include the obvious: the same tools that enable defenders to find vulnerabilities faster are available to adversaries. You do not need a team of elite researchers to run automated analysis against a target's public-facing application code or dependencies. You need access to the tools, time, and motivation.
Nation-state actors and well-resourced criminal groups have been using automated discovery techniques for years. What's changed is the accessibility threshold. The gap between what sophisticated attackers can do and what a modestly resourced attacker can now replicate is closing. The defender advantage from AI-assisted bug finding only materializes if defenders actually fix the bugs — which requires a functional disclosure and patch pipeline.
If AI floods vendors with 500 valid reports and vendors triage 80 in time, the remaining 420 are sitting in a tracker while someone else works from the same list.
## What Has to Change
Vendors need to treat security response as infrastructure, not overhead. That means dedicated intake capacity, clear SLAs, and tooling that can help triage AI-generated reports at volume — which, somewhat inevitably, means using AI on the receiving end too.
The CVE ecosystem needs reform that matches the current discovery rate. The NVD backlog crisis of 2024 was a warning. A program designed in an era of hundreds of disclosures per month is not engineered for what's coming.
Researchers and vendors need clearer default timelines that account for volume. The traditional 90-day disclosure deadline was designed for a world where each report was a discrete event requiring human back-and-forth. Bulk AI-generated disclosures require different handling — triage windows, severity prioritization, batched coordination.
None of this happens without investment. The industry has treated disclosure infrastructure as a shared commons for two decades, contributing to it only when reputationally convenient. AI just made the cost of that neglect much more visible.
---
## HackWire Analysis
The framing of AI as a double-edged sword in vulnerability discovery is accurate but undersells the structural problem. The real issue is that coordinated disclosure was never designed for volume — it was designed for the occasional brilliant researcher who found one career-defining bug per year. That model broke quietly as bug bounty programs scaled, and it's about to break loudly as AI tooling becomes standard kit.
What's missing from most coverage of this story is the vendor-size disparity. Large vendors — Microsoft, Google, Apple — have mature PSIRTs with real engineering capacity. They'll adapt. The acute risk sits with mid-market and enterprise software vendors who've grown through acquisition, carry enormous legacy codebases, and have one or two security engineers covering everything from penetration testing to incident response to patching. These are the vendors whose products run in hospitals, utilities, financial institutions, and manufacturing plants. When their disclosure pipeline fails, the consequences aren't embarrassing blog posts. They're exploited critical infrastructure.
There's also a timing angle here that deserves attention. We're entering a period where several AI-assisted auditing platforms are going commercial simultaneously. The volume curve on vulnerability discovery is going to steepen significantly over the next 12-18 months. Vendors who aren't building intake capacity now are going to find themselves years behind when the reports start arriving in bulk.
The NVD backlog crisis was a stress test. The AI disclosure wave is the actual test. The industry failed the rehearsal.
— HackWire Editorial
---
## Related Coverage