Can AI models find software security holes faster than people?

Some AI models are now good at finding software security holes, but how much faster than people is disputed and depends on who measured it. A security hole, called a vulnerability, is a bug that creates a security risk. Patches fix known ones, but unknown ones, called zero days, can still be exploited.

In April 2026, Anthropic said it was not releasing its Claude Mythos Preview model to the public, citing its ability to find software vulnerabilities, and gave some companies access to scan critical software. In June 2026 it released a related model for general use with safeguards that, according to the company, hand flagged cybersecurity requests to a less capable model. Two weeks after that limited release, Mozilla announced it had found and patched 271 security vulnerabilities in Firefox using the model. According to an encyclopedia account, Mozilla engineers also wrote that a few months earlier AI-generated bug reports had mostly been unwanted slop.

Not everyone agrees on what the numbers mean. Anthropic said the model found vulnerabilities in every major operating system and browser, but an independent security researcher cast doubt, saying the claims could not be verified outside promotional documents. Another independent test found that one of the headline vulnerabilities was also found by 8 of 8 tested open-source models.

The same skill can be used to attack. In 2026, according to an encyclopedia account, a financially motivated actor used open-source AI agents to automate an attack campaign against online retailers. Because attackers can build exploits faster than a patch is rolled out, defenders and attackers are in a race, and both sides are using AI.