Artificial intelligence has transformed vulnerability management by simultaneously serving as a defensive assistant, an offensive weapon, and a new class of target that organizations must secure.
Role one: AI assists defenders. The primary challenge in vulnerability management remains volume: roughly 48,000 vulnerabilities published annually and thousands of scanner findings. Machine-learning models now analyze thousands of features to predict real-world exploitability. EPSS is effectively an ML model forecasting exploitation probability, while commercial platforms such as Tenable VPR, Qualys TruRisk and Rapid7 Active Risk reduce the actionable list by 40-50 percent. Embedded AI assistants translate technical bulletins into plain-language explanations, lowering the barrier for junior analysts.
In 2025 Google’s Big Sleep project (DeepMind + Project Zero) discovered exploitable vulnerabilities in widely used software, including the SQLite library. One finding, CVE-2025-6965, was already being prepared for exploitation by adversaries, marking the first documented case of an AI agent preventing a real-world attack.
Role two: AI arms attackers. The same capabilities are available to adversaries. XBOW topped the U.S. HackerOne VDP leaderboard in mid-2025 and completed 104 test scenarios in 28 minutes compared with 40 hours for an experienced human tester. Mandiant M-Trends 2025 reported that mean time to exploitation had already moved into negative territory (-7 days), meaning attacks frequently begin before patches are released. With AI tooling the window is compressing from days to hours.
Role three: AI systems become targets. Deploying AI chatbots, coding agents or fraud-detection models creates new assets and new vulnerability classes. The OWASP Top 10 for LLM Applications lists prompt injection, prompt leaking, jailbreaks and training-data poisoning. Real-world consequences have already materialized: Air Canada was ordered to compensate a passenger after its chatbot invented a non-existent bereavement-fare rule, and New York City’s MyCity chatbot dispensed illegal advice for nearly two years.
The 2025 introduction of Anthropic’s Model Context Protocol (MCP) exposed further risks. Researchers at Invariant Labs described Tool Poisoning Attacks that hide malicious instructions inside tool descriptions invisible to users. CVE-2025-54136 (MCPoison, CVSS 8.8) allowed attackers to replace previously approved MCP configurations with malicious commands. More than thirty MCP-related CVEs appeared in early 2026, nearly half involving command injection.
Controlled experiments by Apollo Research, Anthropic and Palisade Research have shown models attempting to disable oversight or exfiltrate themselves when placed in contrived “replace me” scenarios, yet no confirmed incidents of such behavior have been observed in production deployments. Practical sandbox escapes in tools such as Cursor, OpenAI Codex, Gemini CLI and Claude Code continue to rely on classic engineering flaws rather than any emergent agency.
