AI System Finds 14,000 New Software Vulnerabilities in Two Months

AI-Powered Vulnerability Discovery Reaches Industrial Scale

Palo Alto Networks has demonstrated how frontier AI models are fundamentally accelerating vulnerability discovery, building an autonomous system that found 14,090 previously unreported software flaws in just two months—work that would have taken years using traditional methods.

The company's vulnerability research team developed the Network and Open-Source Vulnerability Analyzer (NOVA), an agentic system that analyzed 3,915 open-source software projects across six major programming ecosystems. Of the vulnerabilities discovered, 99.4% were previously unreported, and 40% qualified as high or critical severity under the CVSS 4.0 scoring system.

According to research first reported by Palo Alto Networks' Unit 42 team, NOVA operates entirely autonomously until final human review, performing tasks including source code analysis, vulnerability identification, proof-of-concept creation, validation in isolated environments, patch generation, and disclosure reporting.

Why it matters

This research reveals a structural shift in the cybersecurity landscape: the window between vulnerability discovery and potential exploitation has collapsed. When AI can find thousands of flaws in weeks, attackers using similar technology can reverse-engineer patches and develop exploits at comparable speed. Organizations can no longer rely on traditional 55-day patch cycles—they need protections deployed in hours, not months.

Beyond Traditional Fuzzing

The vulnerabilities NOVA identified differ significantly from those found by previous automated tools. Memory corruption bugs—the primary target of traditional fuzzers—represented only 4% of findings. The remaining 92% consisted of semantic and logic flaws including access control failures, path traversal issues, code injection vulnerabilities, and server-side request forgery.

Different programming ecosystems showed distinct vulnerability patterns. C and C++ projects exhibited memory-safety issues, JavaScript and TypeScript showed code injection and prototype pollution, while PHP, Java, and Python applications revealed access-control weaknesses.

Supply Chain Amplification

The research identified 5,421 supply-chain vulnerabilities, where flaws in dependency packages created over 4,000 downstream exposures in applications using those libraries. For 2,776 of these downstream exposures, NOVA validated exploitability with working proof-of-concept code.

Multi-Model Ensemble Approach

Palo Alto Networks found that using multiple AI models together proved essential. In controlled testing across 14 projects, different models consistently discovered distinct vulnerability sets in the same codebase. The highest-performing model found 235 confirmed vulnerabilities, including 185 unique to that model, while even the lowest-volume model contributed 93 findings no other model detected.

NOVA employs specialized agents for different tasks—code review, exploit development, verification, and scoring—with different models selected based on their strengths for each function. The system runs behind multiple containment layers including containers, sandboxing, virtual machines, and network controls to safely handle untrusted code at scale.

In response to these findings, Palo Alto Networks is partnering with open-source maintainers and clearinghouses including Lightwell and Akrites for responsible disclosure. The company has also launched Advanced Virtual Patching technology designed to deploy protections within hours of vulnerability discovery, reducing the exposure window from the industry average of 55 days to near-zero.

The research details were published by Palo Alto Networks' Unit 42 threat intelligence team.