Topic
The use of large language models and automated analysis to find, confirm, and write up software vulnerabilities, available to defenders and attackers alike.
Faav, 16, impersonated an administrator on Microsoft's internal Titan service with an unsigned token, reaching an estimated 17.3 trillion rows. Microsoft disabled the API four days after his report and paid a $5,000 bounty.
Reality
A flaw in NASA's open-source AIT-GUI lets unauthenticated requests reach spacecraft command routes, and Cycode says a malicious web page can deliver them through an operator's browser.
Perspective Coverage
4 publishersReality
Hacktron's report puts the vulnerable code in libheif, two dependency steps below an ImageMagick call on OpenAI's Discourse forum, and says the upstream fix never went through the usual security advisory process.
Reality
Oracle says AI-powered identification is part of why its July Critical Patch Update ran to 1,449 fixes across 334 products, and the nine steps between a finding and an installed patch are the same as they were last year.
Reality
Microsoft's September release addressed 972 CVEs, the largest count it has ever shipped. Within hours a researcher published a working proof-of-concept against CVE-2026-69414, the second fix for a Defender flaw first patched in July.
Reality
Apple says AI-generated submissions are flooding its review pipeline, so it capped open vulnerability reports and added a 30-day cool-down. The one blocked researcher named so far had filed 13 reports across two years.
Reality