On the same day, tech media gigazine reported that developer @0x_Osprey created a web-based CVE Tracker, turning the evolution of CVE-assigned vulnerabilities into a visual chart that clearly illustrates the near-vertical rise observed since 2026.
CVE is the globally recognized vulnerability numbering system, used by security researchers, software vendors, and enterprises to track, report, and fix defects. The CVE Tracker organizes these public records into trend graphs and thoughtfully superimposes the release dates of major AI models, allowing users to quickly determine whether there’s a correlation between peak vulnerability discoveries and model launches. (Currently, this site only offers a dark-mode interface.)
It’s worth noting that AI companies often exploit test versions to identify and report vulnerabilities well before official model releases. As a result, the timing of model launches may not necessarily coincide with peaks in vulnerability discovery.
More reports don’t mean systems are more dangerous
gigazine concludes that AI is serving as an “amplifier” for security research—accelerating code scanning, reproducing anomalies, and compiling findings into reports, bringing even previously overlooked corners of software into the scope of investigation. With efficiency dramatically improved, the sheer volume of detected vulnerabilities naturally rises.
However, the report also cautions against overinterpretation: “more vulnerabilities being discovered” does not equate to “systems becoming more dangerous.” Increased reporting can uncover genuine risks, but it may also include low-quality, duplicate, or unverifiable noise, thereby adding extra burden to open-source maintainers and security teams tasked with triaging alerts. As AI lowers the threshold for identifying vulnerabilities, distinguishing true threats from false positives and avoiding being overwhelmed by massive volumes of reports has become a new challenge.