# Security vulnerabilities in the AI era: building got cheap, running did not

## Security vulnerabilities in the AI era: building got cheap, running did not

### Manuel Simma

![Porträt von Manuel Simma, Developer bei Digit-One](https://www.digit-one.com/_next/image?url=https%3A%2F%2Fcdn.sanity.io%2Fimages%2Fp48sl94f%2Fproduction%2F50c1511d9eb2531550d02603bab94ef57fe5c9fe-1920x1281.jpg&w=1920&q=75)

Full-Stack Developer @ Digit-One

2026-10-29

AI finds vulnerabilities at a pace we have never seen, and on the side it builds websites, apps and shops in an afternoon. What it does not speed up is everything in between: checking, testing, rolling out, taking responsibility. That is where the risk sits in 2026. What the studies show, what is behind the headlines about Claude Mythos, what vibe coding and AI agents change, and what all of this means for you if you run a website or an online shop.

By the end of October 2026, around 87,000 vulnerabilities had been published, **almost twice as many as in all of 2025**

23 minutes

## More vulnerabilities, faster attacks, slower patches

Three numbers sum up 2026 quite well. By the end of October, around 87,000 vulnerabilities with a CVE number had been published, compared with just over 48,000 in all of 2025. According to Mandiant, attacks now start before the patch on average. And according to Verizon, organisations need longer than a year ago to close known vulnerabilities.

A gap is opening between these trends. AI has made finding vulnerabilities cheap, and it has made building software cheap. Checking, testing and rolling out fixes is almost as slow as it always was. And for more and more code that AI writes for non-developers, nobody feels responsible as the operator.

Our thesis for this article: **in the AI era, security is less a question of code and more a question of operations.** If you run a website or a shop, asking whether everything was built securely is no longer enough. The more important question is: who closes the next vulnerability, how fast, and who is liable if it takes longer?

We work with AI ourselves, including for the research behind this article. So this is not a text against AI. It is a text about what AI does to running websites.

**At a glance**

**Around 87,000** CVEs by the end of October 2026, compared with just over 48,000 in all of 2025.

**Minus 7 days:** estimated average time to exploit a vulnerability in 2025, measured from the patch release.

**43 days:** median time to fully remediate known vulnerabilities, up from 32 a year earlier.

**56 percent** of AI-generated code samples pass Veracode's security tests, almost unchanged for years.

![Veröffentlichte Sicherheitslücken (CVEs) 2025 und 2026](https://www.digit-one.com/_next/image?url=https%3A%2F%2Fcdn.sanity.io%2Fimages%2Fp48sl94f%2Fproduction%2F52179f881c3a3d0b399c852708f2e9f7902f25de-3200x1828.png&w=1920&q=75)

## Is AI really finding more vulnerabilities?

Yes, on a scale that surprised even the experts. With [48,185 published CVEs](https://jerrygamblin.com/2026/01/01/2025-cve-data-review/), 2025 was already a record year. By 28 October 2026, an [analysis](https://craci.com/resources/CVE-publication-trends) of the official CVE list counted 87,545. September alone brought [14,934 new entries](https://cyber-hire.com/blog/cve-volume-2026), compared with 4,319 in September 2025.

The forecasts cannot keep up. In June, the Forum of Incident Response and Security Teams (FIRST) raised its 2026 forecast to [around 66,000 CVEs](https://www.first.org/newsroom/releases/20260615) and explicitly named AI-assisted vulnerability discovery as a driver. Reality is now well above that.

The infrastructure behind it is straining. The US agency NIST, which maintains the National Vulnerability Database, reports [263 percent more submissions](https://www.nist.gov/news-events/news/2026/04/nist-updates-nvd-operations-address-record-cve-growth) between 2020 and 2025. In April 2026 it gave up on processing everything: open entries published before 1 March 2026 are now only handled by priority.

For Germany, the federal security agency BSI counts an average of 119 new vulnerabilities per day in its [2025 situation report](https://medien.bsi.bund.de/lagebericht/en/zusammenfassung-und-bewertung/), around 24 percent more than a year earlier. The BSI itself notes that part of the increase comes from changed reporting practice. Not every new CVE is a new risk. The direction is still clear.

### Noise or real findings?

For a long time the answer was: mostly noise. Daniel Stenberg, maintainer of curl, a tool that runs on billions of devices, wrote in July 2025 that only [about 5 percent](https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/) of reports were real vulnerabilities and about 20 percent were AI-generated slop. At the end of January 2026, curl ended its [bug bounty programme](https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/).

Then it flipped. In April 2026 curl received twice as many reports as in 2025, but [15 to 16 percent](https://daniel.haxx.se/blog/2026/04/22/high-quality-chaos/) of them were confirmed vulnerabilities. Linux kernel maintainer Greg Kroah-Hartman [said in March](https://theregister.com/2026/03/26/greg_kroahhartman_ai_kernel): “Something happened a month ago, and the world switched. Now we have real reports.”

That is exactly the new problem. Real findings require real work: verifying, assessing, writing a fix, testing, shipping. AI does the first step in seconds. People still do the rest.

**Quick definitions**

**CVE:** a public identifier for a known vulnerability, such as CVE-2025-55182.

**Exploit:** code that actually takes advantage of a vulnerability.

**Patch:** the update that closes the vulnerability. You are only protected once it is installed on your system.

**Zero-day:** a vulnerability that is attacked before a patch exists.

## Claude Mythos: what is behind the headlines

In April 2026, Anthropic presented the model Claude Mythos Preview as part of [Project Glasswing](https://www.anthropic.com/glasswing). It reportedly found thousands of severe vulnerabilities in operating systems and browsers and was not released publicly because of that capability. After the first month, Anthropic spoke of more than 10,000 high or critical findings, according to [CyberScoop](https://cyberscoop.com/anthropic-mythos-software-flaws-glasswing/). Mozilla fixed [271 vulnerabilities](https://blog.mozilla.org/en/firefox/privacy-security/ai-security-zero-day-vulnerabilities/) found with Mythos in Firefox 150.

Those are figures from the parties involved. Independent checks paint a more sober picture. In September, the security firm VulnCheck [counted again](https://www.vulncheck.com/blog/anthropic-glasswing-receipts): of the 26,153 findings Anthropic cites, 2,736 had made it into the public disclosure ledger, or 10.5 percent. 202 had been fixed, or 0.8 percent.

At curl, [one of five](https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability) reported Mythos vulnerabilities turned out to be real, with low severity. Stenberg still considers AI-powered code analysis significantly better than classic tools. Both are true at the same time.

And how often are AI-found vulnerabilities actually attacked? Of 1,061 vulnerabilities VulnCheck could attribute to AI-assisted discovery, [14 were known to be exploited](https://www.vulncheck.com/blog/state-of-exploitation-1h-2026) in the first half of 2026, or 1.3 percent.

For you as an operator this means: **a finding is not yet a confirmed vulnerability, and a confirmed vulnerability is not yet a fix.** The headline is unsettling, but the real question is a different one: how fast does a fix reach you when a real vulnerability shows up in one of your dependencies? Anthropic itself [expects](https://www.anthropic.com/news/expanding-project-glasswing) many other AI companies to have models of this class within six to twelve months. Then actors with less restraint will have this capability too.

**What is Claude Mythos?**

A model series by Anthropic. The first version, Claude Mythos Preview, was presented in April 2026 and specialises in finding software vulnerabilities. Anthropic did not release it publicly but first gave it to partners who use it to check their own and open source software.

## Attacks often start before a patch exists

The time between patch and attack has been shrinking for years. Mandiant, Google's incident response unit, measures it regularly. In 2018 and 2019 there were still [63 days](https://cloud.google.com/blog/topics/threat-intelligence/time-to-exploit-trends-2023) between patch and exploitation on average, in 2021 and 2022 it was 32 days, in 2023 only 5.

In its current report [M-Trends 2026](https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026), Mandiant estimates the average for 2025 at minus 7 days. On average, exploitation now happens before the vendor releases a patch. For the sixth year in a row, exploits are the most common way into a network, at 32 percent. And once an attacker has access, the median hand-off to the next group takes 22 seconds.

VulnCheck arrives at a similar picture with a different method: in 2025, [28.96 percent](https://www.vulncheck.com/blog/state-of-exploitation-2026) of known exploited vulnerabilities were attacked on or before the day they were published. In the first half of 2026 it was 23.43 percent.

One important caveat: this trend started before AI was widely used. AI did not cause it, but it speeds it up. According to [Axios](https://www.axios.com/2026/07/21/ai-models-cyberattacks-software-flaws), a security firm observed a working exploit nine hours after a critical vulnerability became known in July 2026. A published patch is also a blueprint: whoever compares what changed in the code finds the vulnerability.

**What “minus 7 days” means**

Mandiant measures the time between a patch being released and the first observed exploitation. A negative value means attackers were faster than the vendor on average. For these vulnerabilities, even the fastest patch process does not help. What counts then is architecture and protective layers that slow an attack down until the fix arrives.

![Zeit zwischen Patch und Ausnutzung (Mandiant)](https://www.digit-one.com/_next/image?url=https%3A%2F%2Fcdn.sanity.io%2Fimages%2Fp48sl94f%2Fproduction%2F2b0634d47f7807aad5f52bdbc180aa16a0846960-3200x1828.png&w=1920&q=75)

## Defenders are getting slower, not faster

The other side of the gap looks no better. For the first time, the 2026 Data Breach Investigations Report by [Verizon](https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf) ranks vulnerability exploitation as the most common entry point into breaches, at 31 percent. At the same time, the median time to full remediation rose from 32 to 43 days. Only 26 percent of the vulnerabilities on the US agency CISA's list of known exploited vulnerabilities were fully remediated, down from 38 percent the year before.

This is not about laziness, it is about volume. At the bug bounty platform HackerOne, [nearly 70 percent](https://www.hackerone.com/reports/6th-annual-hacker-powered-security-report) of surveyed security leaders say validated findings arrive faster than they can fix them. Their backlog of open critical findings grew by 123 percent in two years.

Put the measurements side by side and the gap becomes tangible. They come from different studies and do not measure exactly the same thing, but the direction is clear: attacks start before the patch on average, and it takes a median of around six weeks until the patch is installed. **A monthly maintenance slot is therefore too slow for self-hosted software.**

**Austria**

In the [KPMG study](https://kpmg.com/at/de/media/press-releases/2026/kpmg-cybersecurity-studie-2026.html) Cybersecurity in Austria 2026, ineffective patch management was the entry point in 40 percent of attack cases. Half of the 1,396 companies surveyed see AI-assisted attacks as their biggest challenge.

## What this means for websites and online shops

Websites are right in the middle of this. Content management systems, above all WordPress plugins, accounted for [around a third](https://www.vulncheck.com/blog/state-of-exploitation-1h-2026) of all known exploited vulnerabilities in the first half of 2026.

Patchstack, a security vendor specialising in WordPress, counted [11,334 new vulnerabilities](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/) in the WordPress ecosystem for 2025, 42 percent more than the year before. 91 percent of them were in plugins. For 46 percent, no patch was available when they were published. For heavily exploited vulnerabilities, the weighted median time to mass exploitation was five hours.

Shops are no different. Six weeks after the patch for the Magento vulnerability SessionReaper, [around 62 percent of stores](https://sansec.io/research/sessionreaper-exploitation) were still unpatched, according to Sansec.

Modern stacks are not exempt either. React2Shell (CVE-2025-55182), a vulnerability in React Server Components that also affected Next.js, was published on 3 December 2025. Amazon saw exploitation attempts [within hours](https://www.aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182), Bitsight [within 48 hours](https://www.bitsight.com/blog/cve-2025-55182-analysis-of-react2shell-exploitations).

And a week ago, the PHP vulnerabilities that became known as php2shell. On one of its own decoy systems, Amazon registered an exploitation attempt [four days before the patch](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/). Whether it would have succeeded is unclear; successful attacks have only been confirmed after the patch. We wrote up what this means for WordPress, Shopware and other PHP systems in a [separate article on php2shell](https://www.digit-one.com/en/insights/php-vulnerability-php2shell).

### The platform decides who patches

How much of this load lands on you depends heavily on what your website runs on.

**Shopify.** Shopify patches the platform, checkout and payments itself. Apps, theme code, embedded scripts, admin accounts and API keys stay with you.

**Headless with Sanity and Next.js.** The CMS runs as a service, so the attack surface on your own servers is small. The frontend and its dependencies remain your job, or your agency's. According to [Datadog](https://securitylabs.datadoghq.com/articles/nextjs-middleware-auth-bypass/), projects hosted on Vercel and Netlify were not affected by the Next.js vulnerability CVE-2025-29927. With React2Shell, hosted projects needed an update as well.

**Self-hosted WordPress, Magento or Shopware.** Here the operator carries the full patching load: server, PHP, CMS, plugins and themes.

**Vibe-coded app.** The access rules live in generated code that often nobody knows in detail. More on that in a moment.

No option is secure by default. But the question of who patches what belongs in every platform decision, just like features and licence costs.

**For shops that take card payments**

Since 31 March 2025, the card industry standard PCI DSS 4.0.1 requires scripts on payment pages to be inventoried, authorised and monitored for changes. Merchants with an outsourced checkout must [confirm](https://blog.pcisecuritystandards.org/important-updates-announced-for-merchants-validating-to-self-assessment-questionnaire-a) that their site is not susceptible to script-based attacks.

[Shopify service](https://www.digit-one.com/en/shopify/service)

Updates

Support

## Vibe coding: when professionals no longer build

Andrej Karpathy coined the term in [February 2025](https://x.com/karpathy/status/1886192184808149383): “There's a new kind of coding I call vibe coding”. The idea is to describe software in prompts only and stop looking at the code. A year and a half later it has become a mass phenomenon. On the platform Lovable, more than 200,000 new projects are created every day, according to [TIME](https://time.com/collection/time100-most-influential-companies/2026/lovable/). At Google, 75 percent of new code is AI-generated, according to [Sundar Pichai](https://blog.google/innovation-and-ai/infrastructure-and-cloud/google-cloud/cloud-next-2026-sundar-pichai/), but reviewed and approved by engineers.

The difference lies in that last clause. How secure AI code is on its own is something Veracode has been measuring since 2025, with the same 80 tasks across more than 100 language models. In 2025, [45 percent of the code samples](https://www.veracode.com/press-release/ai-generated-code-poses-major-security-risks-in-nearly-half-of-all-development-tasks-veracode-research-reveals/) contained security flaws. In the 2026 report, [56 percent](https://www.veracode.com/news/llms-are-getting-smarter-but-not-safer-veracode-2026-genai-code-security-report-finds-ai-generated-code-security-has-stalled-at-56%25-pass-rate/) pass the security tests, which Veracode calls “virtually unchanged”. The highest-scoring model reaches 68 percent. Against cross-site scripting, a classic website vulnerability, only [15 percent of the samples](https://veracode.com/blog/spring-2026-genai-code-security) passed in spring 2026.

So the code is getting better functionally, but hardly more secure. Apiiro measured this in large enterprise repositories: 76 percent fewer syntax errors, but [322 percent more](https://apiiro.com/blog/4x-velocity-10x-vulnerabilities-ai-coding-assistants-are-shipping-more-risks/) privilege escalation paths and 153 percent more design flaws. **The errors move from visible to invisible.** With professionals, a review catches some of them. If you build an app from prompts as a non-developer, there is nobody to review it.

### What happens in practice

The incidents almost always follow the same pattern: a database in the background whose access rules the generated code does not set, or sets wrongly.

In apps built with Lovable, a security researcher found [303 vulnerable endpoints](https://nvd.nist.gov/vuln/detail/CVE-2025-48757) across 170 projects in 2025, exposing names, email addresses and API keys. The issue was assigned CVE-2025-48757 with a severity of 9.3 out of 10; Lovable disputes it.

Escape scanned more than [5,600 public vibe-coded apps](https://escape.tech/blog/methodology-how-we-discovered-vulnerabilities-apps-built-with-vibe-coding/) and found more than 2,000 vulnerabilities, over 400 exposed secrets such as API keys and 175 cases of exposed personal data.

According to [Axios](https://axios.com/2026/05/07/loveable-replit-vibe-coding-privacy), the security company RedAccess counted around 380,000 publicly accessible apps and pages built with Lovable, Base44, Replit and Netlify. Around 5,000 of them exposed sensitive corporate data.

On the platform Moltbook, which its founder says was built entirely with AI, [Wiz](https://wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys) found 1.5 million API tokens and around 35,000 email addresses exposed.

Researchers at Georgia Tech now count vulnerabilities that trace back to AI-generated code: 6 in January, 15 in February and [at least 35 in March 2026](https://infosecurity-magazine.com/news/ai-generated-code-vulnerabilities).

And who is responsible? Replit CEO Amjad Masad called publicly accessible apps “expected behaviour”, and according to [Computerwoche](https://www.computerwoche.de/article/4169486/sicherheitslucke-vibe-coding.html) Lovable says an app's configuration is ultimately its creator's responsibility. That is understandable. But it also means that many of these apps have nobody who sees themselves as the operator.

**What is vibe coding?**

Software development in which people only describe what they want and an AI writes all the code. Typical tools are Lovable, Bolt, v0, Replit or Cursor. For prototypes this is hugely helpful. It becomes critical as soon as real customer data, payments or credentials are involved and nobody checks the code.

## Agentic engineering: when AI agents build and operate

The next step is already happening. According to the 2026 developer survey by [Stack Overflow](https://stackoverflow.blog/2026/10/06/the-results-of-the-2026-developer-survey-are-here/), 66 percent of developers who work with AI use coding assistants or agents. Agents do not just write code. They run commands, deploy and access databases.

Two cases show what can go wrong. In July 2025, a Replit agent deleted the production database of the company [SaaStr](https://fortune.com/2025/07/23/ai-coding-tool-replit-wiped-database-called-it-a-catastrophic-failure/) in the middle of an explicit code freeze. In April 2026, an agent in the Cursor editor deleted the production database of the start-up PocketOS, including backups, [in nine seconds](https://www.techspot.com/news/112207-ai-coding-agent-running-claude-wiped-startup-database.html).

In both cases the cause was not evil AI but missing operational hygiene: permissions that reached too far, no clean separation between test and live systems, backups in the wrong place. Exactly the things that should be settled in every professional project before go-live.

On top of that come new attack paths through the tools themselves. In August 2025, a manipulated version of the [npm package Nx](https://www.bleepingcomputer.com/news/security/ai-powered-malware-hit-2-180-github-accounts-in-s1ngularity-attack/) used locally installed AI tools to search machines for credentials. 2,180 GitHub accounts were affected. Language models also occasionally invent package names that do not exist, and attackers register exactly those names. This is called slopsquatting. In December 2025, OWASP, the organisation behind the well-known top 10 lists for web security, published its own [Top 10 for Agentic Applications](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/).

### AI inside the shop

AI features on the website are a new attack surface too, whether chatbot, search assistant or an agent that places orders. Simon Willison described the risk as the [“lethal trifecta”](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/): access to private data, exposure to untrusted content and the ability to communicate externally. When all three come together, a manipulated text, for example in a product review, can get an agent to hand over data.

Gartner [expects](https://www.gartner.com/en/newsroom/press-releases/2026-04-09-gartner-predicts-25-percent-of-all-enterprise-gen-ai-applications-will-experience-at-least-five-minor-security-incidents-per-year-by-2028) a quarter of enterprise GenAI applications to have at least five minor security incidents per year by 2028, up from 9 percent in 2025. At HackerOne, valid prompt injection reports rose by [540 percent](https://www.hackerone.com/press-release/hackerone-report-finds-210-spike-ai-vulnerability-reports-amid-rise-ai-autonomy) in 2025.

How far a single integration can reach became clear with Salesloft Drift in August 2025. Using stolen access tokens from an AI chatbot integration, attackers got to Salesforce data; according to Google, [more than 700 organisations](https://cyberscoop.com/salesforce-salesloft-drift-attack-spree-google/) were potentially affected. The rules we recommend for agents in a CMS are in our article on [AI agents in the CMS](https://www.digit-one.com/en/insights/ai-agents-in-your-cms).

**Three questions for every AI feature**

Which private data can it read?

Which outside content does it process, such as reviews, emails or web pages?

Can it send anything out, such as emails, links or API calls?

If the answer is yes three times, the feature needs a hard boundary before it goes live.

## Doesn't AI help the defenders too?

It does, and in the long run probably even more than the attackers. Security researcher Bruce Schneier sees the future [clearly favouring the defender](https://schneier.com/blog/archives/2026/04/cybersecurity-in-the-age-of-instant-software.html) for new software. For older software that nobody maintains, attackers keep a window until a patch is installed.

There is evidence for this. In DARPA's AIxCC competition, AI systems [found 54 of 63 planted vulnerabilities](https://www.darpa.mil/news/2025/aixcc-results) and wrote patches for 43 of them, in about 45 minutes on average. According to IBM's [Cost of a Data Breach 2026](https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average), organisations that use AI and automation extensively in security save USD 1.93 million per breach on average. The average breach there costs USD 4.99 million, a new high.

The catch: defensive AI mainly produces one thing, more fixes. Someone has to test and roll them out. The benefit only arrives where someone actively runs the website. **AI helps maintained systems and hurts unmaintained ones.**

**Daniel Stenberg, curl**

“AI powered code analyzers are significantly better at finding security flaws.” If you do not use such tools, you leave the finding to others.

## Who is liable when AI built the shop?

In autumn 2026, three sets of rules come together. This is not legal advice, but you should know them.

**New product liability.** Under the [EU Product Liability Directive](https://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=OJ:L_202402853), software explicitly counts as a product, including software as a service and AI systems. The new rules apply to products placed on the market from 9 December 2026. Compensation can be claimed by natural persons, for example for personal injury, damage to privately used property or the loss of data not used for professional purposes. What is new: a manufacturer cannot simply escape liability if damage results from missing security updates that were within its control.

In Germany, the Bundestag passed the law modernising product liability [on 8 October 2026](https://www.bundestag.de/dokumente/textarchiv/2026/kw41-de-produkthaftungsrecht-1222456); it is due to enter into force on 9 December 2026. In Austria, the draft of a new [Product Liability Act 2026](https://www.parlament.gv.at/gegenstand/XXVIII/ME/151) is under consultation until 12 November 2026.

Whether a custom-built website counts as a product is not yet settled. What is clear: software counts as a product regardless of how it is delivered, pure services and content do not. For shops, portals and web apps it therefore pays to clearly define responsibility for maintenance and security updates in the contract.

**Cyber Resilience Act.** Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities with an [early warning within 24 hours](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847) and a full notification within 72 hours. From 11 December 2027 all obligations apply, with fines of up to EUR 15 million or 2.5 percent of worldwide annual turnover. Pure websites and browser-based web applications are generally not covered; apps, plugins or installable software that are sold usually are.

**NIS2.** In Austria, the NISG 2026 has applied since 1 October 2026 to [around 4,000 companies](https://www.wko.at/it-sicherheit/nis2-uebersicht) and organisations, which must register by the end of 2026. In Germany, the implementing act has applied since 6 December 2025, and the BSI now supervises [around 29,500 entities](https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2025/251205_NIS-2-Umsetzungsgesetz_in_Kraft.html). Even if you are not covered yourself, you often feel the requirements as a supplier in the chain.

What follows in practice is less legal than organisational. Every contract for a website or shop should answer these questions:

- Who installs updates and security patches, and within what response time?
- Who is responsible for third-party plugins, apps and embedded scripts?
- Where is AI used in building and running the site, and who checks the result?
- Who is informed if a data breach is suspected, and how fast?
- Who carries the risk if maintenance is declined or cut back?

[Get in touch](https://www.digit-one.com/en/contact)

### Benno Purin

![Porträt von Benno Purin, Director Clients & Operations und Co-Founder bei Digit-One](https://www.digit-one.com/_next/image?url=https%3A%2F%2Fcdn.sanity.io%2Fimages%2Fp48sl94f%2Fproduction%2F514c41a28280e2171d543d6a9382763f2f4efdeb-2386x1915.jpg&w=1920&q=75)

Director Clients & Operations, Co-Founder @ Digit-One

Want to know who patches what on your website? Let's talk.

None of them needs a corporate security budget. All of them need someone in charge.

## Four things you can settle **now**

## Know what is running

01

A list of all websites, shops, microsites, staging environments, apps and plugins, with version, host and owner. Whatever is not on the list does not get patched.

### Distribute the patching load deliberately

02

Choose platforms that handle updates themselves and keep the number of plugins and apps small. Every extension is one more place where a vulnerability can appear.

### Set a response time

03

Decide for every system how long a critical vulnerability may stay open and how that time is bridged: with a web application firewall, with automated updates and tests, and if in doubt by switching it off.

### AI with guardrails

04

Never run AI prototypes with real customer data before someone has checked access rules and keys. Never let agents work with production permissions or without separate backups.

## Outlook: what 2027 brings

In the short term the gap is likely to widen. [Axios](https://www.axios.com/2026/07/21/ai-models-cyberattacks-software-flaws) describes the expectation that for the next two to three years there will be a gap between the moment attackers automate and the moment defenders benefit. Anthropic expects many AI companies to have models with Mythos-level capabilities by mid-2027.

On vibe coding, Gartner is blunt. In a forecast [quoted by ArmorCode](https://www.armorcode.com/blog/your-genai-code-debt-is-coming-due-heres-what-gartner-predicts), it says prompt-to-app approaches adopted by non-developers will increase software defects by 2,500 percent by 2028. On top of that there is a blind spot: many AI-generated apps carry vulnerabilities that never get a CVE number and therefore do not show up in any statistic.

On the regulatory side, the next date is fixed: from 11 December 2027 the Cyber Resilience Act applies in full.

We expect a two-speed market. Teams that use AI with review, minimal permissions, controlled dependencies and automated tests will become faster and more secure at the same time. Next to them grows a long tail of websites, apps and shops that nobody operates and whose security debt only becomes visible when something happens.

### What this means for agencies

The role shifts from building to operating. A landing page without data, a prototype for a workshop, an internal experiment: AI alone is often enough for these, and that is fine. As soon as customer data, payments, integrations or liability are involved, someone needs to be responsible for architecture, permissions, updates and emergencies. With a name and a response time.

For agencies this also means: use AI in development and define beforehand what it may do. No agent with production permissions, dependencies checked automatically, and for every project a clear answer to who does what when a new vulnerability appears. The value of a website will depend less on how fast it was built than on how fast someone reacts.

[Hosting & service](https://www.digit-one.com/en/services/hosting-and-service)

Maintenance

SLA

[Headless websites](https://www.digit-one.com/en/web/headless-websites)

Sanity

Next.js

## Is AI finding more vulnerabilities than before?

Yes. 48,185 CVEs were published in 2025, and by the end of October 2026 there were already around 87,000. The Forum of Incident Response and Security Teams explicitly names AI-assisted vulnerability discovery as a driver. Not every new CVE is a new risk, though: part of the increase is due to changed reporting practice, and only a small share of vulnerabilities is actually attacked.

### What is Claude Mythos?

Claude Mythos is a model series by Anthropic. The first version, Claude Mythos Preview, was presented in April 2026 as part of Project Glasswing and specialises in finding software vulnerabilities. Anthropic speaks of more than 10,000 severe findings. An independent count by VulnCheck in September 2026 found that only a small share had been disclosed and 0.8 percent had been fixed.

### Is vibe coding secure?

Not by itself. In Veracode's 2026 tests, only 56 percent of AI-generated code samples pass the security check, and scans found thousands of vibe-coded apps with open databases and API keys. For prototypes and experiments without real data, vibe coding makes sense. Before customer data, payments or credentials are involved, someone should check access rules, keys and dependencies.

### How fast are vulnerabilities exploited today?

Often faster than a patch is available. Mandiant estimates the average time to exploit in 2025 at minus 7 days, measured from the patch. According to VulnCheck, around 29 percent of known exploited vulnerabilities in 2025 were attacked on or before the day they were published. For heavily exploited WordPress vulnerabilities, Patchstack measured a weighted median of five hours to mass exploitation.

### Is a Shopify store more secure than a self-hosted shop?

It shifts a large part of the patching load. Shopify patches the platform, checkout and payments itself; with self-hosted Magento, Shopware or WooCommerce that is the operator's job. Even on Shopify, apps, theme code, embedded scripts, admin accounts and API keys stay with you. No platform is secure by default.

### Who is liable if an AI-built website is hacked?

This is not fully settled yet. Under the new EU Product Liability Directive, software explicitly counts as a product from 9 December 2026, and missing security updates can establish a manufacturer's liability. Whether a custom-built website falls under it is open. Platforms such as Lovable and Replit place responsibility for configuration with the creator. Define responsibilities in your contract and get legal advice for your specific case.

### What should I do now as a website operator?

Four things: keep a complete list of all systems with version and owner, prefer platforms that handle updates themselves, decide for every system how long a critical vulnerability may stay open, and set clear rules for AI, such as no agents with production permissions and no real customer data in unchecked prototypes.

## Conclusion: security is a question of operations

AI finds so many vulnerabilities that the databases cannot keep up, attacks often start before the patch, and vibe coding produces software nobody feels responsible for. That is no reason to be afraid of AI. It is a good reason to take operations seriously. The decisive question for your website or shop is no longer how well it was built, but who closes the next vulnerability, how fast, and who is accountable for it.

[Get in touch](mailto:benno.purin@digit-one.com)

### Benno Purin

Director Clients & Operations, Co-Founder @ Digit-One

“Interested? I'd be happy to tell you more!”