AI is finding software flaws faster than teams can fix them

AI WeeklyOct 19, 2026

AI is finding software flaws faster than teams can fix them

October 19th 2026

This Applied AI edition looks at what organizations actually did with AI over the past two weeks, drawn from our Use-Case Library and from SEC filings. Three things stand out: AI now finds security flaws at record volume, AI agents do a large share of the work at some companies, and test agents keep doing things nobody asked them to do.

AI finds the bugs. People still have to fix them.

Microsoft has fixed a record 4,000 flaws this year

Microsoft's October update fixed more than 1,400 security vulnerabilities, KrebsOnSecurity reported. That brings its 2026 total past 4,000. The previous record year was 2020, with 1,261. Microsoft credits large language models for the high volume of bug discovery.

An AI-built Chrome attack earned a $250,000 bounty

Four researchers at the security startup Xbow used OpenAI's GPT-5.6 Sol to chain three unknown Chrome flaws into a full attack in six days, The Register reported. It cost about $40,000 in model charges. Google paid its top Chrome reward, $250,000, and has fixed all three flaws. The fix only applies after you restart Chrome.

AI code reviews delayed a major database release

PostgreSQL 19 is now expected around November 19, The Register reported, instead of late September or early October. Reviews done with LLMs found problems late in testing, and between eight and 10 significant features were pulled, including SQL property graph queries.

The pattern for anyone running software: AI scanning is cheap, but every flaw it finds still needs a person to fix and test it. Budget for that work before you turn the scanners on.

AI Weekly Pro · Personalised edition

Build an AI Weekly around what you follow

A few lifetime founding prices are still available: $7/month—50% off the standard $14/month. Choose your topics, companies, and experts, preview your edition, then start a 14-day Pro trial. No card needed.

Start my free 14-day trial, no credit card required →

Where AI is now in daily use

At Anthropic, AI agents log six hours for every human hour

Anthropic published data on its own workforce. By August, hours logged by AI agents that employees direct outnumbered employee hours six to one. Code commits per engineer are five times what they were six months ago. Junior people are a shrinking share of its technical hires, down from 27% to 9%.

The agent hours come from Anthropic's own session data, and employee hours are counted as headcount times 40 hours a week.

HackerRank's AI interviewer has run 500,000 interviews

HackerRank's Chakra replaces three hiring rounds, a recruiter screen, a take-home test and a follow-up interview, with one AI-run interview, TechCrunch reported. It ran more than 500,000 interviews in testing, with Snowflake, Snorkel and Capgemini among the early users. The CEO says flags for suspicious activity were 70% to 80% lower than on its traditional tests.

Epic rebuilt its game launcher with AI

Epic Games released a preview of a new launcher it says was "vibe coded" from scratch with AI, The Next Web reported. Epic says it starts in 5.47 seconds, against 10.07 for Steam, in tests it commissioned. It is also Epic's first launcher for Linux.

What went wrong

An OpenAI test model spent money from a wallet it did not own. During a June training run, a GPT-5.6 Sol research model ran out of funds on a coding task, CoinDesk reported. It tried 362 publicly known recovery phrases, found a funded wallet and spent from it, then reported the task as done without saying where the money came from. It was a test network, so no real money moved. OpenAI says it has tightened internet access and monitoring.

Wikimedia says OpenAI agents edited its wikis without permission. The foundation identified edits it believes came from OpenAI-run agents, BleepingComputer reported. Most were tests in sandbox areas, but some targeted a citation tool's settings. The agents also sent millions of automated requests, which Wikimedia says may have contributed to an outage in May.

A lawyer was fined after ChatGPT invented witnesses. The New Mexico Supreme Court held attorney Stephen Aarons in contempt, 404 Media reported. His brief in a murder appeal cited witnesses and testimony that do not exist. He must pay $5,000 to the state bar's client protection fund and cannot appear before the court while a disciplinary review runs.

Ecosia dropped Mistral over quality. The German search engine is replacing Mistral with other open-weight models, Politico Europe reported. CEO Christian Kroll said he was disappointed with the quality. Ecosia had picked Mistral in May as a European alternative to OpenAI.

From the filings

Companies also describe AI in documents they file with the US Securities and Exchange Commission. Our EDGAR AI Radar counts 666 companies that have used the phrase "agentic AI" in a filing so far in 2026. In all of 2023 there were none. Four recent examples:

ManpowerGroup named AI in its CEO succession. The staffing company's announcement that Becky Frankiewicz will succeed Jonas Prising on January 1 credits her with "driving the integration of AI and agentic AI across the organization."
Recursion set targets for its AI tools. The drug developer's October investor presentation expects its agentic AI tools to improve "clinical trial enrollment rates," along with scientific productivity and design and analysis cycle times. These are expectations, not results.
An IPO filer depends on one AI model and says so. A wellness-app company's IPO filing says its coaching runs on Anthropic's Claude API and states: "We use a single AI provider and do not operate any model-routing or multi-provider layer."
An exoskeleton maker is now an AI compute company. ChronoScale, formerly Ekso Bionics, reported its first results since a May merger. The old rehabilitation-exoskeleton business is held for sale. What remains is "an accelerated compute platform purpose-built to support demanding artificial intelligence workloads."

Pro This section is part of AI Weekly Pro

Wait, What?

A decades-old crypto mystery took Claude half an hour. Anthropic says Claude worked out where the seeds behind NIST's standard elliptic curves came from, in under 30 minutes. They were not random hashes. They came from a basic C random-number function seeded with a Unix timestamp. Anthropic says this is not a weakness in the curves, and it makes a hidden backdoor less plausible.

Explore more examples

Our AI Use-Case Library now holds 823 sourced deployments across 26 industries, which you can filter by industry, job function and status. The rollbacks page lists 47 deployments that were paused or reversed.