# AI Exploit Discovery Is Creating a 'Vulnerability Tsunami'
> AI is accelerating exploit discovery and shortening attack timelines to seconds, creating a 'vulnerability tsunami' that current defensive postures can't handle.
**Source:** Broke It (https://brokeit.dev/posts/ai-exploit-discovery-is-creating-a-vulnerability-tsunami/)  
**Published:** 2026-10-29
**Original source:** https://www.forbes.com/sites/georgealove/2026/10/28/ai-drives-the-2026-cybersecurity-threat-landscape-at-machine-speed/
**Topics:** cybersecurity, AI safety, vulnerability, hacking, AI risk

---

AI-assisted vulnerability discovery is accelerating far beyond our current defensive capabilities. The recent AI-aided discovery of a critical PHP flaw is a concrete example of the 'vulnerability tsunami' that security leaders from OpenAI and Cloudflare are warning about. Most engineering teams are not equipped to handle machine-speed attacks.

## What's the new threat?

The core issue is that AI models are becoming exceptionally proficient at static and dynamic code analysis, finding subtle security flaws in large codebases. OpenAI's Sam Altman and Cloudflare's Matthew Prince have both stated that AI will be used to find and exploit security flaws at an unprecedented scale. This shifts the economics of offense, making sophisticated exploit discovery cheap and fast.

## How fast are machine-speed attacks?

A recent CrowdStrike report found adversaries using AI had a breakout time—the time from initial compromise to lateral movement—of just 27 seconds. This is not enough time for a human to even process an alert, let alone respond. Manual incident response for initial containment is now a broken model. Your on-call engineer will get paged after the attacker has already established persistence.

<a href="https://www.forbes.com/sites/georgealove/2026/10/28/ai-drives-the-2026-cybersecurity-threat-landscape-at-machine-speed/" rel="nofollow noopener">A Forbes analysis reinforces this</a>, detailing how AI is fundamentally changing the speed and sophistication of cyberattacks. The focus is moving from just finding vulnerabilities to weaponizing them into functional exploits almost instantly, closing the gap between discovery and attack.

This 27-second window means your security playbook is obsolete if it begins with 'page the on-call engineer.' The first line of defense must be a fully automated system. This requires Security Orchestration, Automation, and Response (SOAR) platforms that can autonomously block, isolate, and remediate based on AI-detected patterns, without waiting for human approval.

## Should you use AI for defense?

Yes. You no longer have a choice. Fighting machine-speed attacks with human-speed response is a losing strategy. The only viable path forward is fighting AI with AI. This means implementing AI-driven security monitoring, anomaly detection, and autonomous response systems. Offensive AI is developing rapidly, and defensive postures based on signatures and manual intervention are insufficient.

## FAQ

### What is the 'vulnerability tsunami'?
It describes a massive increase in security vulnerabilities being discovered and exploited by AI tools. The speed and scale of these AI-driven discoveries are expected to overwhelm traditional, human-led cybersecurity defense teams.

### How fast is a 'machine-speed' attack?
CrowdStrike has recorded an attack where the adversary moved from initial access to lateral movement within the network in just 27 seconds. This is faster than a human can typically react to an initial security alert.

### Is AI more dangerous than a human hacker?
AI acts as a massive force multiplier for human hackers. It grants them the ability to find and test vulnerabilities at a scale and speed that was previously impossible, combining human intent with machine efficiency.

<p class="related-inline">Related: <a href="/guides/agent-sandboxes/">Sandboxing AI agents and the code they write</a> · <a href="/posts/openai-agents-escape-vms-find-rce-in-brotli/">OpenAI Agents Escape VMs, Find RCE in Brotli</a></p>