Google: AI agent found the BeyondTrust vulnerability that was exploited four days after disclosure
Google Threat Intelligence Group (GTIG) published its report "Vulnerability Discovery and Exploitation Trends in the AI Era" on 30 September 2026, offering the most data-rich picture yet of how AI is reshaping the vulnerability landscape. The core pattern is not more zero-days, but faster exploitation of known vulnerabilities — and the case that illustrates the mechanism is concrete: a command injection vulnerability in BeyondTrust products, discovered by a third-party AI research agent, was exploited by one threat cluster within four days of public disclosure, and by five more clusters within seven days.
What the Report Shows
GTIG's figures for 2026 sketch a landscape in rapid flux:
- Disclosures doubled: Monthly vulnerability disclosures rose from 5,045 in January 2026 to 10,477 in July and on to 10,740 in August, according to GTIG's primary source (Google Cloud Blog).
- Exploitation grew far faster than zero-days: The average number of exploited vulnerabilities per month went from 10.5 in 2025 to 18 in 2026, while zero-day exploitation rose only from 8 to 11 per month.
- The year broke the record in eight months: GTIG recorded 141 distinct disclosed-and-exploited vulnerabilities from January to August 2026 — more than the full-year 2025 total of 127 (Industrial Cyber).
- High-Risk exploitation more than doubled: From 28 to 75 exploited High-Risk vulnerabilities. High-Risk disclosures rose from 131 in January to 350 in August, growth of 167% — yet they still make up only 3% of all disclosures.
The pattern that stands out, then, is that the gap between disclosure growth and zero-day growth is being filled by something else: faster exploitation of vulnerabilities that are already known and patched.
The Case That Shows the Mechanism: CVE-2026-1731
The most illustrative single case in the report is CVE-2026-1731, a command injection vulnerability in BeyondTrust products. What makes it special is that it was discovered by a third-party AI research agent — not by a human.
According to GTIG, threat actors began exploiting the vulnerability within days of public disclosure. One threat cluster exploited it within four days, and five more within seven days (Help Net Security). The attackers escalated privileges, exfiltrated data, and dropped payloads including SNOWLIGHT, SPARKRAT, and cryptominers.
The case shows the chain that worries GTIG: AI finds a vulnerability, the vulnerability is published with a CVE ID, and a roadmap is thereby laid out for any attacker who is paying attention. The faster the public vulnerability picture fills with concrete, exploitable flaws, the shorter the window between "known" and "exploited" — and it is this n-day window, not the zero-day problem, that is shrinking.
AI Findings Are More Serious Than Average
GTIG also found that vulnerabilities discovered with AI assistance have a different risk profile from the broader ecosystem: the share that enables remote code execution (RCE) was 50% among AI-discovered vulnerabilities, versus 26% across the ecosystem as a whole (TechRadar via MSN). AI-assisted discovery, in other words, found proportionally fewer low-risk findings and more moderate and severe ones.
At the same time, the report documents that AI-related software has itself become a major attack target. GTIG tracked 2,076 vulnerabilities in AI-related software from January 2025 to August 2026, more than 1,500 of which were disclosed in 2026 alone. Half of this year's disclosures hit agent orchestration frameworks such as Flowise and Langflow — the infrastructure organizations are increasingly building AI functionality on.
Where the Numbers Require Caution
The dramatic growth in disclosures, however, must be read with caveats — and it is GTIG itself that warns of them.
The most telling example is the Linux Kernel: vulnerabilities with "Linux Kernel" in the description alone generated roughly 5,000 CVEs between January and August 2026, without GTIG observing any exploited zero-days in the wild. That points to a significant portion of disclosure growth possibly being inflated by automated CNA policies — that is, numbering authorities mass-registering vulnerabilities that do not necessarily represent real risk. The bottom line supports that picture: only 0.23% of all vulnerabilities disclosed in 2026, roughly one in 431, were observed exploited in the wild.
That does not mean the trend is insignificant. The flood of disclosures creates a classification and prioritization problem for defenders, and the numbers that directly measure attacker behavior — exploitation per month, High-Risk exploitation, time to exploitation — all point the same direction. But raw volume growth is not, in itself, a measure of how exposed the world has become.
There is also a data quality problem on the AI side: public data likely underreports how many vulnerabilities are actually AI-found. According to GTIG, CVE records lack standard tagging for AI attribution, and cloud and SaaS vendors patch silently without requesting CVE IDs. The 50% RCE figure is therefore based on the cases that can be identified.
Is the LLM Explanation an Assumption or a Finding?
GTIG itself draws a clear line between observation and explanation. The report suggests that threat actors may be using language models and AI tools to automate the analysis of differences between product versions, patches, vulnerability advisories, and proof-of-concept code — in order to rapidly weaponize n-days, rather than find new zero-days. But this is explicitly presented as a possibility, not a documented causal link: "It is possible that threat actors are finding it more accessible or efficient to use LLMs and AI tools to automate analysis of differences between product versions, patches, vulnerability disclosure announcements, and Proof-of-Concept (POC) code to rapidly weaponize n-days, rather than to discover new zero-days," the report states.
The fact that zero-day exploitation rose only marginally (8 to 11 per month) while n-day exploitation surged has prompted interpretation beyond Google as well. Steve Povolny, vice president of AI strategy and security research at Exabeam, pointed out in comments on the report two possible conclusions: "This leads to one of two conclusions: first, AI models are very good at uncovering known (N-day) vulnerabilities but not mature enough to discover widespread zero-day vulnerabilities of significance," he said (IT Pro). The other possibility is that AI-driven zero-day discovery is happening but is being concealed by the attackers — a thread that remains unresolved and cannot be verified from public data.
Microsoft's Digital Defense Report 2026, published the same week, points in the same direction from another major player. Terrell Cox, CVP and deputy chief information security officer at Microsoft, writes that AI gives defenders new ways to find and remediate weaknesses, but that the same advances can also give threat actors more capable tools for vulnerability discovery and exploit development (Microsoft Security Blog). The reports from the two competing vendors are independent of each other, but converge on the core point: AI makes vulnerability analysis faster for all parties.
What It Means for Prioritization
The practical conclusion for organizations is that patching priorities should shift. The problem is not primarily unknown zero-days, but known vulnerabilities that are exploited within days. The four-day figure from the BeyondTrust case is shorter than many organizations' patching cycles for edge systems.
The attack surface is also concentrated: vulnerabilities in edge and security equipment made up 14% of exploited vulnerabilities from January to August 2026, and a further 11% hit enterprise directory and collaboration hubs (Industrial Cyber). More than 65% of the exploited edge vulnerabilities carried GTIG's High or Critical threat risk rating. Internet-exposed security products and central authentication and collaboration platforms are where attackers actually are.
GTIG further expects both vulnerability discovery and exploitation to continue growing over the short to medium term.
What Remains Open
Three questions remain after the report. First, the LLM assumption is unverified: GTIG has observed faster n-day exploitation but has not proven why. Second, the zero-day question is unresolved — either AI is not yet mature enough for such discoveries, or it is happening without showing up in public data, as Povolny framed it. Third, disclosure volume will continue to be a noisy metric as long as automated CNA policies can register thousands of low-risk CVEs, as the Linux Kernel example shows.
What is solid after eight months of 2026 is this: more vulnerabilities than ever are being published, a larger share of them are severe, a growing share are found by AI agents — and the time from disclosure to exploitation is shrinking. Roughly one in 431 disclosed vulnerabilities was observed exploited in the wild — but the ones that were, came faster than before.