Security patches need patches now that attackers have AI

Updating your software only gets you so far. A scary scenario – security fixes themselves being bypassed – is becoming more common, according to AI penetration-testing startup Terra Security, which found a sharp rise in reported patch failures in 2026 after years of relatively low numbers. And no, it’s not a coincidence that AI vulnerability discovery and patching also exploded this year. For example, Russian government cyberspies exploited a zero-day Windows Shell security bypass bug, CVE-2026-21510, at least a month before Microsoft patched the flaw in February. Redmond’s patch, however, was incomplete, and left a second flaw – a zero-click authentication coercion vulnerability (CVE-2026-32202) – that was also found and abused before Microsoft fixed it in April. Terra researchers reviewed every published CVE record and GitHub-reviewed advisory looking for broken fixes, and found a distinct pattern. After six years of relatively few patch bypasses, this changed in 2026: “A fix would ship, a bypass would be found, and another fix would go out.” The share of GitHub security fixes that required a follow-up advisory reporting a failed patch within 90 days remained at about 0. 2 percent between 2019 and 2025. This year, this figure had jumped to 2. 3 percent, according to the researchers…