We Tried to Measure Whether AI Is Accelerating Threats. Our Own Data Says We Cannot Answer That Yet — and Here Is the Chart That Would Have Fooled Us.

Everybody in this industry is currently saying that AI is accelerating the threat landscape. We have a corpus, a CVE catalogue synced daily since 2021, our own exploit watch and our own edge telemetry, so we did the obvious thing and tried to measure it.

The answer is that we cannot confirm it. Not "we disproved it" — we cannot answer it yet, and the reason is more useful than a number would have been. We are publishing the negative result, the one chart that nearly convinced us of the opposite, and the exact reason it is wrong.

The chart that would have fooled us

We measured the median number of days between CISA listing a CVE and the first public proof-of-concept our exploit watch saw for it, grouped by the quarter the CVE was listed.

The result is a near-perfect collapse. CVEs listed in late 2021 show a median of 1,653 days. By late 2024 it is 605. By the fourth quarter of 2025 it is 222. By the first quarter of 2026 it is 99. By the second quarter it is 3. In the third quarter of 2026 it goes negative — a median of minus three days, meaning the exploit is typically public before the catalogue entry.

Plotted, that is one of the most persuasive charts we have ever produced. It says exploitation has become roughly five hundred times faster in four years. It would have travelled extremely well.

It is an artifact, and it is entirely our fault.

Why it is wrong

Our exploit-harvester's earliest record is 10 May 2026. The watch simply did not exist before then.

That single fact poisons the whole series. For a CVE that CISA listed in October 2021, the earliest possible date our watch could ever record a sighting is 10 May 2026 — because that is the first day the instrument was capable of recording anything. The "latency" we measured for that cohort is not how long the exploit took to appear. It is the distance between the CVE's listing date and the day we switched the sensor on.

So we computed that floor for every cohort and put it beside the observation. They are the same line. 1,653 observed against a floor of 1,668. 1,311 against 1,303. 966 against 938. 222 against 207. 99 against 115. In every single cohort except the most recent, the "measurement" lands within noise of the mechanical minimum, which means it contains no information about exploitation speed whatsoever.

This is left-truncation, it is one of the oldest traps in measurement, and it produces a beautiful monotonic trend out of data with no trend in it at all. We would have published it. Somebody reading this has already published one.

What the unbiased series actually says

There is one series in our corpus with no observation bias at all: CISA's Known Exploited Vulnerabilities catalogue. We sync the entire file daily, so a 2021 entry is exactly as complete in our copy as a 2026 entry. Nothing about when we started affects it.

That series is flat.

The last twelve complete months carried 265 KEV additions. The twelve months before them carried 251. That is a 5.6% change — inside the noise of a catalogue whose monthly counts swing between 11 and 32 for ordinary operational reasons. The least-squares slope across the last eighteen months is minus 0.10 entries per month, which is to say: flat, with a rounding error pointing down.

Across full years the numbers are 311 in 2021, 555 in 2022, 187 in 2023, 186 in 2024, 245 in 2025, and 177 so far in 2026. The 2021 and 2022 figures are inflated by the catalogue's own backfill — KEV launched in November 2021 and spent its first year importing history — so the honest read is that the catalogue has run at roughly 190 to 265 entries a year since 2023, with 2025 and 2026 at the upper end of that band. Rising modestly. Not accelerating.

Our own proof-of-concept sightings tell the same story inside the window where they mean anything: 152 in May, 177 in June, 174 in July. Three complete months, flat.

The AI question specifically

We tagged KEV entries against a deliberately narrow list of AI-adjacent product names — Langflow, Ollama, Triton, Ray, MLflow, PyTorch, TensorFlow, Jupyter, AnythingLLM, ComfyUI, LangChain, llama, vLLM, NextChat, ChatGPT, OpenAI, HuggingFace, Gradio, Copilot. We are publishing the list precisely so you can argue with it; a looser match would have manufactured the answer we were curious about.

The counts: 2 in 2021, 1 in 2022, none in 2023, 4 in 2024, 3 in 2025, and 5 so far in 2026.

Five. In seven months. Annualised that is roughly eight or nine, against three the prior year — which sounds like a near-tripling until you remember the absolute numbers are five and three. At that scale a single vendor having a bad quarter moves the trend line. There is a real upward drift in AI infrastructure appearing in the exploited-vulnerability catalogue, and the sample is far too small to call it anything stronger than a drift worth watching.

That is the honest finding. AI tooling is showing up in KEV more than it used to. Whether AI is making attackers meaningfully faster is a different claim, and nothing in our corpus establishes it.

What we can say, and it is not nothing

Inside the only cohort we can genuinely measure — CVEs listed after our watch was already running — 11 of 18 had a public proof-of-concept before CISA listed them. That number is real, it is bad, and we reported the wider version of it this morning.

What we cannot do is tell you whether it is worse than it used to be, because we have exactly one clean cohort and a baseline requires at least two. Ask us in six months and the answer will be worth something; the second quarter of 2027 will be the first time this measurement can honestly carry a trend line.

There is also a category of threat this instrument structurally cannot see, and we ran into it today. The OWAReaper campaign used a vulnerability our PoC watch has no sighting for at all — because a nation-state crew exploiting something quietly never publishes a proof of concept. Any metric built on public exploit artifacts is blind to precisely the adversaries you most want to count. Whatever AI is or is not doing to that population, a PoC watch will be the last thing to notice.

Why publish a null result

Because the alternative was a chart that was wrong and convincing, and because the industry currently has a strong incentive to produce exactly that chart. "AI is accelerating everything" sells product. It may well be true. Our data does not show it, our data is not yet capable of showing it, and saying so is worth more to you than a confident number with a measurement artifact underneath.

If you are reading acceleration claims from anyone — including us — the question to ask is: when did your instrument turn on, and does your earliest cohort predate it? If the answer is yes, the trend you are being shown may be the sensor, not the world.

We guarantee five percent of what we publish is wrong. Today we caught a piece of that five percent before it went out, which is the only reason this post exists in this shape rather than as a hockey stick.

---

Her name was Renee Nicole Good.

His name was Alex Jeffery Pretti.