AI Software Bugs: More Than 1,300 Found. Hackers May Be Next.

📅 Last Updated: October 28, 2026 | TechVerveMedia

TechVerveMedia Analysis: AI software bugs are piling up fast: OpenAI says its models have helped researchers find more than 1,300 in open-source code since it started hunting in May. Security teams cannot triage, patch and verify fixes at that pace.

Patching is the bottleneck, not discovery. Weaponization is lagging for now, because the PHP flaws behind the scare have proven unusually hard to exploit.

The 1,300 Bug Milestone

The New York Times reported Wednesday that OpenAI began using its technology in May to search for vulnerabilities in open-source software.

OpenAI says its models have helped internal and external researchers identify more than 1,300 bugs.

The targets are open-source projects: foundational, widely used and free.

Axios names two prominent finds by OpenAI agents. PHP, used by roughly 70% of websites, and Brotli, a widely used data-compression library.

Anthropic separately disclosed that an unreleased internal research model found critical vulnerabilities in widely used browsers and operating systems. The model then combined multiple flaws into five working attack chains.

The Lab Reality vs. Mass Scanning

Anthropic published its disclosure on October 27, 2026. It says the chains came after prompting, went to vendors through coordinated disclosure, and all identified vulnerabilities have been patched.

Chrome on macOS

• One-click remote code execution outside the browser sandbox.
• Launched Calculator from a stock default configuration.
• 62 CVEs assigned and patched as of Chrome 156.
• Includes 13 sandbox escapes and 21 renderer-compromise issues.

Safari

• One-click same-origin-policy bypass.
• Exposed cookies, history and authenticated cross-site data.
• Apple acknowledged the report the same day.
• A fix is available to users.

Android / Pixel 9

• Photos and personal data extracted from a locked, stolen phone over USB.
• Google has addressed the issue.

Windows

• Remote denial-of-service against HTTP/3/QUIC servers.
• Repeated packets could keep a server crashing.
• CVE-2026-33096, reported to Microsoft and resolved.

Linux kernel

• Zero-click remote code execution as root on servers with a multipath TCP listener.
• CVE-2026-98432, patched upstream.
• Backported to all maintained stable kernel branches.

These are laboratory proof-of-concept exploit chains, not confirmed use in live attacks.

Anthropic’s central warning: frontier models can now discover, combine and validate multi-step vulnerabilities with little human involvement. That shrinks the traditional gap between bug discovery and usable exploitation.

The real world looks different so far. Axios reports that millions of hacking attempts have produced few successful attacks.

The PHP flaws that triggered the scare have proven unusually difficult to exploit, and defense work by many companies appears to have helped.

Inside “Black October”

Axios says security researchers dubbed October “Black October” after a chaotic week of AI-discovered software flaws and attacks on platforms powering the AI boom.

Axios lists OpenAI agents finding critical PHP and Brotli flaws, plus breaches at OpenCode, Railway and LiteLLM.

OpenCode is an AI coding agent, Railway a developer platform and LiteLLM an AI gateway. The breaches exposed customers’ API keys and other credentials.

Axios’s assessment: mass scanning and attempted exploitation are underway, but successful mass attacks have not arrived at the feared scale.

The much-anticipated automated wave has been slow to launch.

Experts warn against complacency, because the lull reflects exploitation difficulty and defensive action, not a drop in AI offensive capability.

Samantha Lewis, head of threat intelligence at Armadin, told Axios the next wave could launch hours from now, not years.

Former NSA cyber division head Rob Joyce warned that the “transition from vulpocalypse to breachpocalypse is here.”

The Patching Bottleneck

AI is accelerating vulnerability discovery faster than security teams can triage, patch and verify fixes.

Axios frames the next era around resilience: rapid detection, containment and recovery, rather than prevention alone.

The Defensive Playbook

Axios cites four moves.

Lock Down Access

• Turn on multi-factor authentication.

Plan for Recovery

• Identify critical services.
• Set restoration priorities.

Find Weaknesses First

• Test proactively for exploitable weaknesses.

Fight at Machine Speed

• Use AI defensively.

TechVerveMedia Verdict / Editorial Note:

Panic does not match the record: millions of attempts have produced few successful attacks, and Anthropic’s lab exploit chains rest on flaws that have all been patched.

Complacency does not match it either, because the lull reflects hard-to-exploit flaws and active defense, not a ceiling on what AI can do.

Keep browsers and operating systems updated, because the fixes Anthropic describes are already shipping.

Know which services matter most and the order you would restore them.

Enforce multi-factor authentication, and test your own systems before someone else does.

The Bottom Line

OpenAI’s 1,300-plus bugs and Anthropic’s five lab exploit chains show AI is finding flaws faster than defenders can fix them. Real-world attacks remain limited for now, and experts say that reflects exploitation difficulty and defensive work, not weaker AI offense.