Summary
Executive Summary Frontier AI is fundamentally shifting the dynamics of cybersecurity — accelerating both how vulnerabilities are discovered and how quickly they can be exploited. Our vulnerability research team built an autonomous vulnerability discovery, validation and reporting system that we call Network and Open-Source Vulnerability Analyzer (NOVA), an agentic research system that leverages proprietary AI harnesses powered by multiple leading frontier AI models. Our goal with this research is twofold: (1) contribute to improving the security of the software supply chain; and (2) ensure our customers are protected from vulnerabilities in the AI era. In just two months, NOVA analyzed 3,915 open-source software (OSS) projects and uncovered 14,090 confirmed vulnerabilities, 99.4% of which were previously unreported and 40% of them designated as high or critical severity. Nearly every frontier and open-weight model evaluated could find real vulnerabilities, with the strongest results coming from an ensemble of models, specialized security tools, and automated harnesses working together. These initial results illustrate just how dramatic the impact of AI is on the vulnerability landscape. In response to these significant results, we are actively partnering with open-source maintainers and clearinghouses such as Lightwell and Akrites to responsibly disclose these vulnerabilities and ensure they are patched upstream quickly and securely. Securing the broader open-source supply chain ultimately protects the entire software ecosystem and benefits everyone. Our experience with NOVA highlights a clear structural change: the patch window has collapsed. When vulnerability discovery accelerates, the time between disclosure and potential exploitation shrinks dramatically. And attackers need not have access to the latest frontier AI model to reverse engineer patches and develop exploits automatically. This new reality also makes virtual patching an even more important defense strategy in the AI era, and is a key driving force behind our recently announced Advanced Virtual Patching, the next evolution in network vulnerability protection. Advanced Virtual Patching is designed to operate at the speed of AI to keep pace with the new normal of higher rates of vulnerability discovery and compressed attack windows. By harnessing frontier AI to discover unknown vulnerabilities, and deploying protections in hours, we are collapsing the exposure window from the industry-average 55 days it takes to deploy a traditional patch down into a near-zero window of exposure. Our new “vaulted protection” technology enables us to deliver protections ahead of patch availability in a safe and responsible manner. In addition to these protections available with our network security platform, we recommend that organizations deploy relevant best practices, including vulnerability management, zero-trust network architecture, software supply chain security, and other attack surface reduction best practices. NOVA: Fully Automated Novel Vulnerability Discovery and Validation Our vulnerability research team built a fully autonomous vulnerability discovery system requiring no human in the loop until final review. We call this the Network and Open-Source Vulnerability Analyzer (NOVA). For each project we analyzed, NOVA performed the following functions:
- Review of the project history
- Reading the source code
- Identification of vulnerability candidates
- Creation of a working proof of concept (PoC)
- Deterministic validation of whether the vulnerability is triggered in a clean environment
- Generation of a patch candidate
- Production of a disclosure report The pipeline has scanned 3,915 projects across six major software ecosystems. It produced findings in every ecosystem we tested, for a total of 14,090 novel vulnerabilities. That scale changes how defenders should think about vulnerability discovery. Large-scale open-source vulnerability automation is not new: OSS-Fuzz launched in 2016 and, by August 2023, had helped identify and fix more than 10,000 vulnerabilities across 1,000 projects. It shows the step-change frontier AI enables: Work that once accumulated across years of specialized automation can now begin to happen across thousands of targets in a single autonomous campaign. Table 1 shows that the findings are distributed across very different software ecosystems:
- The PHP, Java/JVM and C/C++ rows include many larger web platforms, enterprise servers and system software projects, which produced dense clusters of findings per project
- The Go and JavaScript/TypeScript rows include broad package-ecosystem scans, where each individual package often produced fewer findings but could still affect many downstream products
In other words, both large applications and small dependencies matter, but for different reasons. One matters because of direct exposed attack surface and the other because of supply-chain reach.
| Language or ecosystem | Projects | Findings |
| Go | 1,636 | 3,281 |
| JavaScript/TypeScript | 2,197 | 2,836 |
| PHP | 17 | 2,740 |
| C/C++ | 39 | 1,925 |
| Java/JVM | 14 | 1,784 |
| Ruby/Python/Lua/Perl/Other | 12 | 1,524 |
| Total | 3,915 | 14,090 |
Table 1. Autonomous pipeline findings by language or ecosystem.
The projects we analyzed also varied widely in size. Figure 1 shows that most projects we studied were under 10,000 lines of code, but the scan also included larger applications and services. That matters because AI-driven vulnerability discovery is not limited to small demonstrations. The pipeline operated across projects ranging from small packages with hundreds of lines of code to large codebases with more than 1 million lines.
We then checked all 14,090 findings against the public record. Only 85 matched vulnerabilities already present in public sources, most published 2–8 weeks after our discovery. This small overlap suggests that many organizations are now independently scanning open-source software. It is reasonable to assume threat actors are doing the same. As AI-assisted discovery becomes easier to run, maintainers will face a growing volume of vulnerability reports that vary widely in quality, urgency and exploitability.
What Kinds of Vulnerabilities AI Found
Automation to find vulnerabilities is not a new concept. What we see from the NOVA research, however, goes much deeper than previous automations.
Considering memory corruption helps shed light on how frontier AI changes vulnerability research. Memory corruption is one of the areas where vulnerability research was already highly automated before generative AI. Researchers have spent years using fuzzers to prove that machines can find crash-oriented bugs at scale. This is especially true in relation to memory corruption, null dereferences and integer overflows.
While our system found many vulnerabilities in this category, it was not simply covering the same ground as previous automations. The type of vulnerabilities found with previous automations represent only a small fraction of the vulnerabilities found by NOVA. In the taxonomy we used for our frontier AI findings, the closest category, memory and calculation issues represented 557 findings or only 4.0% of the total. Even if resource-management and denial-of-service issues are added, these fuzzing-friendly categories total 1,121 findings — still only 8.0%.
The vast majority of the analysis we did using frontier AI models — 92% — uncovered vulnerabilities of different types. When we look at the remainder we see that the AI harness was especially effective at identifying semantic and logic flaws such as: - Access control and authorization
- Path traversal
- Code injection
- Prototype pollution
- Server-side request forgery (SSRF) We found that different ecosystems presented different types of risks. We broke down vulnerability types in relation to the ecosystems studied in Figure 2. (The figure reports percentages within each language, not raw finding volume, so it should be read as a vulnerability fingerprint for each ecosystem.) The clearest pattern is that the vulnerability mix follows how software is commonly built:
- C and C++‘s issues are dominated by memory-safety and resource-management flaws, the cost of manual memory management
- JavaScript and TypeScript’s issues concentrate in code injection, prototype pollution and SSRF, a byproduct of dynamic, package-heavy code
- Go’s issues skew toward path traversal and SSRF, reflecting its common role in file-serving and proxy services
- PHP, Java and Python’s issues are dominated by access-control and authorization flaws, the classic weak point of applications juggling many user roles
A significant number of the 14,005 new vulnerabilities we found are considered severe.
The Common Vulnerability Scoring System (CVSS), is a standard way to estimate vulnerability severity. Under CVSS 3.1, 4,030 findings (28.6%) scored High or Critical. Under CVSS 4.0, 5,600 findings (39.7%) scored High or Critical. Figure 3 shows the CVSS 4.0 distribution.
Far from producing a long tail of low-impact issues, NOVA identified a substantial amount of vulnerabilities with the potential for real-world impact.
A vulnerability in a standalone service only affects the systems that run it. In contrast, a vulnerability in a low-level package can travel much farther, reaching every application that depends on it.
In the package ecosystems we studied, the pipeline produced 5,421 supply-chain findings: - 1,280 flaws in dependency packages
- 4,141 downstream exposures where an application could reach a vulnerable dependency through its own code
These were not based only on static import checks or dependency graphs. For 2,776 of the downstream exposures, the pipeline validated exploitability from the downstream application with a working PoC.
Figure 4 shows why dependency reach matters. Roughly 1,300 dependency-package flaws created more than 4,000 downstream exposures. For defenders, prioritization cannot depend only on project size or direct deployment. It must also account for where the code is used.
How the Autonomous Research Harness Works
The methodology of AI-driven vulnerability research has changed dramatically in the last two years. In 2024, our AI-assisted BOLA research still required a carefully designed workflow for a narrow vulnerability class, with human researchers defining much of the strategy in advance. In 2026, agentic AI can: - Start from a broader goal
- Inspect a codebase
- Decide where to look
- Build a PoC
- Iterate when validation fails That shift makes AI-driven vulnerability research faster, easier to scale and more useful across many vulnerability classes. That shift does not remove the need for engineering around the model. It makes harness design more important. A single model asked to find vulnerabilities will produce too much noise and still miss important parts of the codebase or entire vulnerability classes. The harness gives the agent a structured workflow:
- Understand the target’s architecture
- Identify where outside input enters
- Locate dangerous operations
- Determine which paths connect the two
This turns a broad audit into a set of specific review obligations, such as whether user-controlled data can reach a file operation, an outbound network request, a database query or a command execution point.
The harness also keeps the work accountable. It records paths that were reviewed, paths that were ruled out and candidates that need proof.
Candidate findings are not accepted just because a model reports them. They are passed to independent validation and replayed in a clean environment. They are then sent through patch review and protection generation. This structure lets agents move quickly while still producing evidence that humans, maintainers and defensive systems can act on.
Figure 5 shows the high-level architecture. Project prioritization decides what to analyze first. Research agents and specialized analysis tools work together to map the code and find candidate paths. Independent validation confirms whether a candidate is real. From there, the pipeline produces patch candidates, disclosure material and virtual patch candidates for defensive coverage.
Figure 6 expands that architecture into the agentic loop that runs for each project. A scoping agent selects the software repository and scan strategy. Discovery agents review the codebase in parallel and generate ranked candidates. Proof-of-concept and verification agents turn strong candidates into working tests and replay them in isolated environments. Gatekeeper agents then score, verify and decide whether to publish, archive or send the project back into the next wave of review.
This is a multi-agent and multi-model design. Code reviewers, exploit developers, adversarial triagers, replay judges and fix-verification agents each perform different jobs, and different models can be selected for the tasks where they are strongest. Discovery is especially ensemble-heavy because it is largely static analysis: multiple models reviewing the same project can cover different code paths and vulnerability classes, which is why the next section examines model complementarity in more detail.
The loop is built to reduce false positives and to operate safely at scale. Candidate findings go through strict validation, isolated replay and continuous adversarial review before they are treated as verified. The pipeline also runs behind multiple containment layers, including containers, gVisor-style sandboxing, virtual machines, network egress controls and least-privilege permissions. That isolation matters because the system is designed to scan hundreds of projects concurrently while handling untrusted code, generated exploits and sensitive artifacts.
We also found that a multi-model ensemble is essential. In a controlled evaluation across 14 projects, different models often found different vulnerabilities in the same codebase.
Figure 7 shows this complementary behavior. A higher score means the models found more distinct sets of issues, while a lower score means they tended to converge on the same findings.
The trend is clear: Small packages usually leave less room for disagreement, while larger applications, services and libraries create more opportunity for models to specialize and uncover different parts of the attack surface.
Figure 8 reinforces the same conclusion. In the evaluation, every model contributed a large set of findings that no other model found. The highest-volume model found 235 confirmed vulnerabilities, including 185 unique to that model in this experiment. Even the lowest-volume model found 139 confirmed issues, including 93 that no other model found. This is why we view the ensemble as a defensive requirement rather than an optimization.
Beating Attackers With Virtual Patching and Industry-wide Collaboration
Our approach to addressing the impact of AI on the vulnerability landscape is to pair earlier discovery with faster protection. Finding vulnerabilities before attackers do is only useful if that intelligence can be turned into customer defenses and coordinated remediation quickly.
Our partnership with leading vulnerability clearinghouses enables us to quickly and proactively report vulnerabilities to software maintainers to ensure security bugs are properly remediated upstream.
As vulnerabilities are patched and disclosed, protections are added to our Advanced Threat Prevention (ATP) service on our next-generation firewall and SASE products to protect customers. With Advanced Threat Prevention, defenders can deploy network-level protections that detect or block exploit attempts before they reach vulnerable software. This is especially important for open-source components embedded across many products, as well as commercial software, operational technology, medical devices and other environments where patching can be slow, risky or constrained by availability requirements.
And with our new Advanced Virtual Patching capability, protections for newly discovered vulnerabilities can be delivered within hours, safely protecting customers before official patches are available.
This approach aligns with our collaboration with Project Lightwell, which combines our rapid network-level protection with software remediation to help organizations reduce exposure to emerging threats.
In addition to our ongoing research in proactive vulnerability discovery, we continue to forge industry partnerships across the enterprise software and OT vendor landscape to accelerate vulnerability disclosure, remediation and customer protection without overwhelming maintainers or enterprise patching teams.
The Path Forward
The vulnerability surge is already underway. AI can compress months or years of manual review into days, and a finding is no longer just a written report. An autonomous agent can often read code, test a hypothesis, generate a working PoC and validate the result in the same workflow.
That changes the economics of both offense and defense, and it narrows the window organizations have traditionally relied on between vulnerability discovery, patch development, patch testing and production deployment.
At the same time, expert judgment remains irreplaceable. Models are powerful at scale, but top human researchers still lead in creative synthesis, complex exploit chaining and unusual intuition. The strongest defensive posture combines: - Autonomous systems for speed and breadth
- Human experts for judgment and prioritization
- Innovative approaches to mitigation The next phase of security will be defined not only by who can find vulnerabilities first, but by who can convert early discovery into protection fastest. As Palo Alto Networks CEO Nikesh Arora has emphasized, this is a moment for cybersecurity providers to step up and shift the advantage back to defenders. Palo Alto Networks is continuing to invest in AI-native vulnerability research, responsible disclosure, partner collaboration and mitigation capabilities so customers can reduce exposure before attackers can exploit newly discovered flaws. The Unit 42 AI Security Assessment can help empower safe AI use and development. Read more about how Palo Alto Networks is utilizing Frontier AI.