FIRST Projects 2026 CVE Count Near 66,000 as Autonomous AI Agents Accelerate Vulnerability Discovery

Summary

FIRST (Forum of Incident Response and Security Teams) projects roughly 66,000 CVEs for 2026, well above year-start expectations. The forecast attributes much of the surge to autonomous AI agents — explicitly naming Anthropic's Mythos and OpenAI's GPT-5.4-Cyber — now finding flaws on their own. Mozilla's collaboration with Anthropic surfaced 271 bugs for the Firefox 150 release through AI-assisted scanning of legacy code, illustrating the scale shift. Why it matters to us: this is the macro coun