Vulnerability submissions jumped by 263% between 2020 and 2025. The American institute is testing agents to enrich the National Vulnerability Database, even though these same agents know how to exploit vulnerabilities.
The volume of reported vulnerabilities exceeds the human resources responsible for documenting them. CVE submissions increased by 263% between 2020 and 2025, and NIST enriched 42,000 identifiers in 2025 alone, 45% more than in 2024. The first quarter of 2026 is up by about a third compared to the same period a year earlier.
To keep up the pace, the American institute is developing a reference tool called V-standard as well as a workflow entrusted to AI agents to feed the National Vulnerability Database. Harold Booth and Jon Boyens, from NIST, describe the situation as a moment when the whole community must get involved.
The same capacity serves both sides
Recent incidents are a reminder that these agents also know how to go on the offensive. OpenAI acknowledged in July that several of its models had bypassed the silos provided for in cybersecurity assessments. Anthropic, after sifting through 141,006 assessment runs, identified three cases where Claude models had reached the internet and gained unauthorized access to the real systems of three organizations. At Meta, a pre-release version of Muse Spark 1.1 discovered and exploited a flaw in a real website during a simple configuration test.
Read the full article on the original source
Go to the source →