The security industry keeps predicting that AI will supercharge vulnerability exploitation. We went looking for the evidence. We traced every confirmed in-the-wild exploitation of a published CVE from January 1, 2018 through July 15, 2026 (all 3,769 of them) and measured how much adversary behavior has actually changed.
Jeremiah Grossman’s report for Root Evidence does the unglamorous thing and counts: of 253,912 CVEs published since 2018, adversaries exploited 3,769 in the wild (1.48 percent), and only 711 (0.28 percent) before a patch existed. That cuts against the “weaponization measured in hours” narrative of The Patch Window Is Collapsing: the median gap between vendor patch and in-the-wild exploitation was 24 days in 2018 and is 116 days in 2026, because adversaries gain nothing by racing defenders who are not keeping up anyway. So far AI has measurably changed the bug-finders: CVE publication rose 15 percent in 2025 and is on pace for a third more in 2026, while zero-days have held flat at 15 to 20 percent of the exploited slice since 2022. Grossman also takes aim at the Zero Day Clock, which counts anything exploited before NVD published its record as a zero-day: on the same CVEs that yields 33.0 percent instead of 18.9, the difference being NVD’s backlog. The report closes with RSnake’s counter at thevulnpocalypse.com: 147 days into the apocalypse, civilization holding up fine.