The Patching Gap: AI, Software Bugs and Cybersecurity

Intro

Over the past week, governments and companies around the world had IT departments working overtime fixing bugs and exploits in their software systems. AI helped uncover another wave of vulnerabilities, this time in PHP, a programming language used by around 70% of websites. $NET CEO said there were millions of attempts to exploit them within hours after they were announced. The flaw had been sitting in the code for years, but was considered too impractical to exploit until AI took the effort away from hackers.

In this post I'll discuss this new trend, the challenges ahead, who benefits, and why I added to my $CRWD position this week.

Finding Bugs Is Cheap Now

The number of software vulnerabilities discovered in 2026 is on track to roughly double last year's total. In June this year there were over 7,500 vulnerability disclosures alone.

A growing share of those vulnerabilities come from AI. Anthropic's Mythos model found a bug in OpenBSD that had gone unnoticed for 27 years. Mozilla fixed 271 vulnerabilities in a single Firefox release after testing Mythos. That’s around 10x more than they found using the previous Anthropic model. OpenAI has similar tools, with theirs helping discover last week's PHP fixes.

Not all bugs and vulnerabilities are the same, most are low or medium severity, but the trajectory of AI’s impact here is clear. The number of bugs being discovered is accelerating at a near exponential rate.

The Hard Part Is Fixing Them

A vulnerability only stops being a risk once it's fixed. The bottleneck is now how quickly bugs can be verified, disclosed and patched, High severity bugs found by Mythos frequently take two or more weeks to fix.

Attackers don't have to wait two weeks. They have access to the same tools, and the PHP case shows how fast they move once a flaw is public. Google's threat intelligence team counted 141 vulnerabilities exploited in the wild between January and August this year, already more than all of 2025.

I expect the next few years to be the most dangerous stretch. Over time, AI scanning should leave software with far fewer hidden flaws. Until then, there's a growing backlog of known bugs waiting to be fixed, and attackers who can find and use them faster than ever.

Who Benefits

Companies that build and run their own software at scale can find their own flaws first, especially those with sizable AI infrastructure. In one Chrome update in July, Google fixed 433 vulnerabilities, and its own teams found 401 of them. The same update a year earlier fixed just 11. That’s good news for $GOOG, my largest holding.

Edge networks like $NET can shield customers' systems while they wait for patches. I’ve recently started building a small $NET position.

Security platforms benefit as companies consolidate onto fewer vendors that can cover more threats. CrowdStrike's own threat report showed an 89% jump in AI-enabled attacks last year.

There are risks. AI labs are moving into security themselves, and reports that OpenAI may buy a security firm hit the whole sector earlier this month. Palo Alto even warns in its own filings that AI could turn parts of vulnerability finding and patching into a commodity.

This for me is becoming the core bull case for investing in major AI names like Anthropic and OpenAI once they go public. I think both can be true though. The labs can do very well supplying the models, while established security platforms do well delivering them to the customers who already rely on them.

I Added to CrowdStrike

Last week I added to $CRWD, which is now around 5.4% of the portfolio. It used to be one of my largest positions, and I think we're still early in this wave of security problems.

CrowdStrike is working with the AI labs as well as competing with them. It's a partner in Anthropic's Project Glasswing, and its new Wayfinder service pairs frontier AI models with its own security experts.

CrowdStrike has already had a big run, and I added after last week's rally. Analysts have been raising their price targets this month, with recent ones mostly in the $265-290 range, which isn’t too far above the current price, but I believe the rapid growth in vulnerability discovery and AI in cybersecurity is still being undervalued.

Closing Comments

AI is making software flaws cheaper to find for defenders and attackers alike. The companies that can fix problems fastest, or protect customers while they wait, should benefit the most. In my next post I'll look at the grid, where patching is much harder, and where my portfolio has a lot of exposure.

Thanks as usual to everyone who follows and copies me. Thanks for taking the time to read this, and I look forward to reading your thoughts in the comments.