AI patch gap: AI is finding vulnerabilities faster than they can be fixed

Researchers analyzed the implications of using AI to discover vulnerabilities in open source projects and concluded that the main challenge is no longer detection, but how fast fixes are delivered.

Key findings: Over nine weeks, the AI identified 1,596 confirmed vulnerabilities across hundreds of open source projects. Independent validation showed a 90.8% true positive rate. However, detection speed and patching speed differ vastly. On average, the system found about 25 confirmed vulnerabilities per day, while developers managed to fix only around 1.5. This creates the so‑called AI patch gap — a growing disparity between vulnerabilities discovered and those remediated. Even after a patch is released, it takes time before updates reach vulnerability databases, scanning tools, and production environments. The authors estimate the full cycle from private disclosure to deployment in enterprise infrastructure can take three to five months.

The authors note that the traditional "discovery → patch → update" cycle is falling behind in the age of automated vulnerability detection. This highlights the need for a contextual approach to vulnerability management — factoring in exploitability, exposure, and real‑world risk.