AI is accelerating hacks as flaw reports nearly triple
Disclosed software flaws nearly tripled to about 37,000 in the third quarter of 2026, executives tell Reuters, as artificial intelligence accelerates attacks and strains defenders.
The figure is from the Common Vulnerabilities and Exposures registry of disclosed flaws. Reuters reports companies from Booking.com to German web host Ionos are now patching around the clock with AI-assisted tools, as events that "used to be months apart" now arrive weekly.
Costs are already landing
Ahold Delhaize, the Dutch grocer behind Stop & Shop and Giant Food in the US, was hit twice in the past month. Reuters reports its mid-October intrusion cost more than €200 million ($225 million) in sales and forced a profit warning after websites and apps were offline for a week.
The 21 October disclosure of two AI-discovered flaws in PHP, the language behind many websites, prompted governments and companies from Tokyo to Helsinki to take sites offline. Cloudflare told Reuters exploitation attempts rose from thousands to millions within hours of disclosure. Holcim took its website offline around 9:30 p.m. on 21 October to install the PHP fixes and restored service before midnight.
Both sides use AI
Booking.com's chief security officer, Marnie Wilking, told Reuters hundreds of engineers there are now building AI-powered defence systems. Ionos said it changed its security practices after a July spike in vulnerabilities, deploying AI-based monitoring and AI-assisted patching around the clock.
These are Reuters figures, not independently verified counts of successful attacks — the 37,000 is disclosed flaws, not hacks — and Reuters does not claim AI caused the tripling. But executives describe the same race: "Both sides use AI, and that race is continuing," Holcim chief financial officer Steffen Kindler told Reuters. McKinsey projects the outside cybersecurity market will grow from $223 billion in 2025 to $346 billion by 2029.
Sources: Reuters, 5 November 2026, as carried by Livemint and summarised by Pivot News; the Reuters original was not opened (Livemint returned 403) — every figure above is attributed to Reuters via that carried summary.
