Ever since AI models started finding exploitable flaws at scale, security teams have been warning about a "vulnpocalypse": more vulnerabilities discovered than anyone can patch. Chris Hughes asked on Resilient Cyber, in a piece called From Vulnpocalypse to Breachpocalypse, whether that worry has now turned into a "breachpocalypse," meaning actual breaches and not just a growing pile of flaws.
It's a fair question, and it gets easier to answer once you notice that "AI-driven attacks" and "AI-found vulnerabilities" are often used as if they were one thing, when they are really two different problems. AI-found vulnerabilities are about how much of what you run has suddenly become exploitable. AI-driven attacks are about how fast an attacker moves inside your environment, and much of that movement doesn't need a vulnerability at all.
AI-driven attacks are about how fast they move once they're in
An attacker with AI agents doesn't work through your environment the way a person does. It tests every permission it lands with, follows every path that opens up, chains together whatever works, and does it at machine speed, so the time between a first foothold and the goal shrinks from days of careful work to minutes. That compresses one of the main resources defenders rely on, the time to notice and respond.
What makes that speed possible is that an AI agent tries every permission and every path without stopping, where a person works through them one at a time. What makes it so hard to stop is that, once it's in, nothing in its path blocks it. It works with what the environment already allows: a credential that opens one more door, a role with more permissions than its job needs, an account that can reach more than it should. That is living off the land. These steps don't exploit a flaw, so there was nothing you could have patched in advance, only access that was set up to allow it. How the agent got in is a separate question, and it may or may not have involved a flaw.
Here is what that looks like in the wild. GreyNoise's report on a campaign against PaperCut servers describes hundreds of AI agents compromising 440 instances at 395 organizations, and two PaperCut flaws got them in. After that, much of the work ran on access the environments already granted: harvesting credentials from process memory and registry secrets, passing the hash to a domain controller, and in one route, in GreyNoise's words, the adversary "simply added its newly created account to Domain Admins." At the 12 organizations where they got to domain admin, it took as little as five minutes.
Microsoft saw the same pattern in its write-up on Storm-0940. The actor used an open-source AI framework to speed up "scanning and reconnaissance, password spraying, and OAuth application abuse at downstream victims," which is valid access from the first step, and the time from targeting to privileged access was less than three hours in multiple cases, a pace that "allows very little time for Defenders to respond."
The paths were already there in both cases, and what changed is that something now tries all of them before anyone has opened a ticket.
AI-found vulnerabilities make almost everything you run potentially exploitable
The second problem is about vulnerabilities in the plain sense. AI can now read code and find exploitable flaws in places nobody used to look, including the minor components that never reached a backlog because no attacker would have bothered. That is the Mythos world, and the question it raises is how much of what you run can be broken into, whether that's the way in or a system further inside.
The UK AI Security Institute's evaluation of Claude Mythos Preview found it succeeds 73% of the time on expert-level tasks that no model could complete before April 2025, and says it can "discover and exploit vulnerabilities autonomously" in controlled tests. AISI is careful about the limits too, saying it "cannot say for sure" whether the model could attack well-defended systems, so the honest version is that the capability is real and how often it shows up in real attacks is still unknown. The finding side is already running at scale: VulnCheck's tally of Anthropic's disclosure ledger shows 26,153 findings claimed under Project Glasswing. Fewer than 10% have even been reported to the teams that build the software and only 202 are confirmed fixed, and Anthropic calls human triage "the rate limiting step."
That is a patching problem before it is anything else, because every flaw AI finds lands in a backlog that grows at machine speed. And it doesn't end there, because much of what AI finds is worse than a backlog item: it is a flaw nobody has even reported yet. VulnCheck's numbers show how much: fewer than 10% of those findings have been reported, so for the other 90%, anyone who exploited one would be exploiting a zero day, a flaw nobody who could fix it knows about, with no patch to apply.
So the problem is more than a never-ending backlog: much of what AI finds is a zero day with no patch at all, however fast your process is. If an attacker can find a way through almost anything you run, a severity score stops telling you which bug is the one that matters, and a backlog ranked by severity stops being a plan.
Two problems, one answer: close what can be reached
AI is causing both of these, and they still break different things. One is about vulnerabilities and the exploits built on them, and the other is about how fast an attacker can move once it's in your environment, where a vulnerability is often not needed.
Side by side:
Close what can be reached and keep it closed
Back to the question Hughes asked: is the vulnpocalypse turning into a breachpocalypse? Everything above points to yes. More flaws means more ways in, and once an attacker is inside, an AI agent moves faster and reaches its goal sooner than anyone can respond, so the pile of flaws turns into real breaches.
Vulnerability discovery at this scale breaks your patching, because there is no longer a backlog you can work through in order. Speed breaks your containment, because by the time a person sees the alert the attacker has already tried the next path. Working harder at patching or at response won't close either gap, and both problems depend on the same thing - access.
That is why the answer sits earlier than either problem: make sure nobody and nothing can reach what it shouldn't, and make sure it stays that way. It pays off on both: a flaw that can't be reached can't be exploited, even when no patch exists, and an agent that gets in anyway finds every path closed and has nothing to speed through.
That is why the solution is action, not more findings: enforcing the guardrails on access, the very thing that blocks an agent in its path, and keeping them in place as your infrastructure changes so the paths don't sprawl back.