Publicly disclosed cybersecurity vulnerabilities reached a record high in 2025 and continued surging through the first half of 2026, driven by artificial intelligence models that accelerate the discovery process. Data compiled by the U.S.-federally funded Mitre Corporation shows global vulnerabilities hit 48,244 cases in 2025, up 2.4 times from 2021.
The Bottom Line
- Global cybersecurity vulnerabilities reached 48,244 recorded cases in 2025, compared to 20,161 cases in 2021.
- During the first half of 2026 alone, researchers documented over 35,000 new software vulnerabilities.
- AI-driven vulnerability detection tools like Anthropic’s Claude Mythos are accelerating the identification of system weaknesses across enterprise networks.
Mitre Corporation Data Reveals Vulnerability Explosion
The Mitre Corporation, which manages federally funded research and development centers in the United States, tracks and catalogs software vulnerabilities to help IT vendors and researchers deploy patches. According to the organization’s disclosures reported by Kyodo News and Debati.bg, annual vulnerability reports hovered around 10,000 cases between 2017 and 2020 before scaling past 20,000 in 2021.
The trajectory steepened following the November 2022 release of OpenAI’s ChatGPT. By 2024, annual disclosures climbed to 40,077, before peaking at 48,244 in 2025. Between January and June 2026, the count already surpassed 35,000 cases, highlighting a persistent acceleration in identified software flaws.
| Year Period | Registered Vulnerability Cases |
|---|---|
| 2017–2020 (Annual Average) | ~10,000 |
| 2021 | 20,161 |
| 2024 | 40,077 |
| 2025 | 48,244 |
AI Models Accelerate Threat Discovery Across Enterprise Infrastructure
Advanced artificial intelligence models are actively reshaping how system weaknesses are found. Security researchers and malicious actors alike deploy automated systems, such as Anthropic’s Claude Mythos, to parse code bases and surface system flaws at speeds traditional security teams cannot match.
This rapid discovery rate places immense pressure on enterprise IT departments. When vulnerabilities are exposed, software patches must be applied immediately to prevent unauthorized access. However, corporate systems frequently remain exposed due to delayed implementation.
Corporate Backlogs and the Labor Shortage in Cybersecurity
The sheer volume of newly discovered flaws has outpaced corporate remediation capacity. Yukimi Soto of Proofpoint’s Japan branch noted that many companies fall behind on defensive actions due to a severe labor shortage within the security sector.
This operational lag manifested in several high-profile incidents across Japan. In recent weeks, Japanese enterprises reported unauthorized access and data leaks, including an intrusion that compromised the personal data of approximately 6.6 million users on the Times Car ride-sharing service. In response, the Japanese government urged businesses to immediately strengthen their baseline security protocols.
