Tech media gigazine reported on the same day that developer @0x_Osprey created a web-based CVE Tracker. It visualizes the number of vulnerabilities that have been assigned CVE numbers, showing a nearly vertical upward curve since 2026.
CVE is a global vulnerability numbering system that security researchers, software vendors, and companies use to track, report, and fix defects. CVE Tracker organizes these public records into trend charts and also overlays the release dates of mainstream AI models, allowing people to easily see whether there is a connection between the peak of vulnerability discoveries and the release of models. (The site currently has a dark interface.)
It is worth noting that AI companies often discover vulnerabilities and report them in a test version before the model is officially released. Therefore, the moment the model goes live may not happen at exactly the time when vulnerabilities are increasing.
More reports mean the system is more dangerous
Gigazine’s judgment is: AI is acting as an “amplifier” for security research—it scans code more quickly, replicates anomalies, and compiles reports, bringing software details that were previously beyond human capacity into the investigation scope. As efficiency increases, the amount of findings naturally grows as well.
But the report also poured cold water on that idea: the discovery of more vulnerabilities does not mean the system is “more dangerous”. More reports may reveal real risks, but they can also contain low-quality, repetitive, or difficult-to-verify noise, thereby increasing the burden on open-source maintainers and security teams. As AI lowers the threshold for discovering vulnerabilities, how to distinguish truth from falsehood and avoid being overwhelmed by a massive number of reports has become a new challenge.