AI-Attributed CVEs of 2026: A Primary-Sourced Tracker With Verified Vendor Credits

An autonomous AI agent was credited on a critical CVSS 9.8 remote code execution flaw in a Microsoft cloud service in March 2026, a first for a machine finder on a bug that severe (NVD, CVE-2026-21536; XBOW, 2026). Two months later an AI lab reported 21 zero-days in FFmpeg for roughly US$1,000 of compute, with nine already assigned CVE identifiers (depthfirst, 2026). A year earlier, Google's Big Sleep agent had already found a SQLite flaw and helped cut off an in-the-wild exploit before it landed (Google, 2025). The AI attacker has stopped being a conference slide and started showing up in the CVE record itself.

That is exactly why attribution now matters more than the headline. Every one of these claims travels through press releases and secondary write-ups that blur who found what, and the difference between "an autonomous agent found it" and "a human used a model as a tool" is the whole story for a defender trying to model the threat. This tracker exists to keep that record straight.

The direct answer

Which real CVEs did autonomous AI agents and AI security firms discover in 2026, who actually found them, and are they patched? At least five verified CVE records across 2025 and 2026 carry an AI finder credit, and all of them are fixed. Three were led by autonomous agents: a Microsoft cloud RCE (XBOW), a SQLite memory-corruption flaw (Google Big Sleep), and a cluster of FFmpeg parser bugs (depthfirst). One was an AI-assisted collaboration where a research firm worked with Claude, credited by Apple on a macOS flaw. One was a hybrid, where XBOW's platform surfaced a critical Exim bug but a human wrote the exploit, so it does not count as autonomous. Two widely repeated pairings were left off because the attribution did not survive a check against the primary advisory.

TL;DR: the numbers that matter

• Highest-severity AI-credited CVE (Mar 2026): an autonomous agent was credited on a CVSS 9.8 Microsoft Devices Pricing Program RCE, CVE-2026-21536 (NVD).

• Cheapest large haul (Jun 2026): depthfirst's agent reported 21 FFmpeg zero-days for about US$1,000, nine now numbered CVE-2026-39210 through -39218 (depthfirst, 2026).

• First AI-foiled exploit (Jul 2025): Google's Big Sleep found SQLite flaw CVE-2025-6965 and helped stop an in-the-wild exploit before it landed (Google, 2025).

• A vendor names the model (May 2026): Apple credited Calif.io, in collaboration with Claude and Anthropic Research, on macOS flaw CVE-2026-28952 (Apple, 2026).

• Critical, but human-written (May 2026): the Exim "Dead.Letter" RCE CVE-2026-45185 (CVSS 9.8) was surfaced by XBOW's platform, but a human won the race to write the exploit (NVD; XBOW, 2026).

• The oldest bug an agent found: one FFmpeg stack overflow in the cluster had been latent since 2003, roughly 23 years, before an AI agent surfaced it (The Hacker News, 2026).

• Every entry is patched: all five records point to a fixed version or a server-side mitigation, so this is a patch-status tracker, not an open-threat feed.

• Two exclusions on accuracy: a Kimi K3 and Redis pairing was left off because the Redis advisory CVEs are credited to human researchers, and the separate Kimi K3 Redis find has no CVE assigned yet.

Key takeaways

• The credit bucket is the whole story, and most coverage gets it wrong. "Autonomous," "AI-assisted," and "hybrid" are three different threat claims. XBOW itself concluded that models alone are not yet ready to write real-world exploits, which is why the Exim RCE is logged as hybrid even though XBOW's platform surfaced it (XBOW, 2026).

• Autonomous agents now reach severity that used to require elite humans. A machine finder credited on a CVSS 9.8 RCE (NVD, CVE-2026-21536) is a different world from the "AI finds low-hanging XSS" framing of two years ago.

• The economics changed before the tooling matured. Roughly US$1,000 of compute for 21 FFmpeg zero-days (depthfirst, 2026) means an attacker can now afford to point an agent at every dependency you ship, not just your crown-jewel app.

• Old code is the new frontier. A 23-year-old FFmpeg stack overflow (The Hacker News, 2026) shows agents are strongest where humans stopped looking: mature parsers, demuxers, and libraries buried deep in the software supply chain.

• Defense has to move at agent cadence. When discovery is measured in runs rather than annual engagements, point-in-time testing leaves a widening gap. Continuous validation is the honest response, and it is why we fold autonomous coverage into our AI-driven offensive security operations.

Methodology

This is a running tracker, refreshed as new dated, verifiable AI-attributed CVEs publish. Inclusion has a hard bar: a real CVE identifier, a named finder, a credit that survives a check against the primary advisory, and a confirmed fixed version or mitigation. Sources used for this pass, with dates:

• Apple. About the security content of macOS Tahoe 26.5, published May 2026, plus the matching NVD record for CVE-2026-28952.

• NVD (NIST National Vulnerability Database). Per-CVE records for CVE-2026-21536, CVE-2026-45185, CVE-2025-6965, and the reserved FFmpeg cluster CVE-2026-39210 through CVE-2026-39218.

• XBOW. The vendor's own write-ups on the Microsoft RCE cluster (March 2026) and the Exim "Dead.Letter" RCE (May 2026), corroborated by trade coverage.

• Google. Cloud CISO Perspectives on the Big Sleep agent and SQLite CVE-2025-6965 (2025).

• depthfirst. The lab's research write-up on 21 FFmpeg zero-days (June 2026), with per-CVE confirmation via NVD.

The research cutoff for this pass is July 2026. CVSS scores are the CVSS 3.1 base values from NVD, noted per row; where a publisher used CVSS 4.0, both are given in the entry detail. Where a CVE cluster is still reserved at NVD, its severities are marked pending rather than estimated, because inventing a score would defeat the point of the tracker. Any figure that could not be reached on at least one verification pass against a named primary source was dropped rather than printed, and no proof-of-concept code or exploit steps are reproduced here. Every figure below links back to its primary advisory so any claim can be audited inline. For the broader disclosure and exploitation context around these individual entries, see our 2026 vulnerability statistics.

The 2026 AI-attributed CVE tracker

This is the running table. Each row states the affected and fixed versions, the finder, the credit bucket (the finder type), the CVSS 3.1 base score, and the single most useful "what to patch now" line. The CVE identifier links to the primary advisory.

Reading the credits: three buckets, not one

The reason this tracker leads with the finder rather than the flaw is that the three credit buckets describe three genuinely different threats. Collapsing them into "AI found a bug" is where most reporting goes wrong, and it is where a defender loses the plot.

Autonomous AI agent means an agent drove the discovery end to end, with a human triaging before disclosure rather than doing the finding. XBOW on the Microsoft RCE, Big Sleep on SQLite, and depthfirst on the FFmpeg cluster all sit here. This is the bucket that should change your threat model, because it scales with compute, not headcount.

AI-assisted, human plus AI means a human researcher used a model as a power tool. The Apple macOS credit names both sides of that collaboration, and that phrasing is deliberate. The find is real and the model mattered, but a skilled human was still steering.

Platform-surfaced hybrid is the one that gets mislabeled most. XBOW's platform surfaced the Exim bug, and it is easy to file that under "AI found it." But a human won the race to turn the finding into a working exploit, and XBOW's own conclusion was that models alone are not yet ready for that last mile (XBOW, 2026). Logging it as autonomous would overstate the state of the art.

The entries in detail

CVE-2026-21536: an autonomous agent on a Microsoft 9.8

The highest-severity AI-attributed credit of the year went to XBOW, a New York based autonomous security company, for a remote code execution flaw in the Microsoft Devices Pricing Program. NVD records it as an unrestricted file upload weakness (CWE-434) with a CVSS 3.1 base score of 9.8, allowing an unauthenticated attacker to execute code with no user interaction (NVD, CVE-2026-21536). Microsoft disclosed it in the March 2026 Patch Tuesday cycle and, because the affected component is delivered as a cloud service, mitigated it server-side (Krebs on Security, 2026).

For defenders, the significance is not a patch action, since there is nothing to install for this specific CVE. It is the precedent. An autonomous system found and reported a critical, unauthenticated RCE in a major vendor's cloud surface without source access. The right response is to confirm your broader March 2026 Patch Tuesday rollout landed, and to assume the same class of agent is now enumerating your own internet-facing upload paths.

CVE-2025-6965: Big Sleep and the exploit that never landed

Google's Big Sleep, built by DeepMind and Project Zero, found a memory-corruption flaw in SQLite affecting all versions before 3.50.2, fixed in 3.50.2 (NVD, CVE-2025-6965). NVD scores it 7.7 under CVSS 3.1, and Google scored it 7.2 under CVSS 4.0. The standout detail is operational: Google says this was the first time an AI agent was used to directly foil efforts to exploit a vulnerability in the wild, combining threat intelligence with the agent to catch a bug that was "known only to threat actors" before it could be weaponized (Google, 2025).

SQLite is one of the most widely embedded pieces of software on earth, so the patch action is bigger than it looks. Updating your system SQLite is the easy part. The harder part is the long tail of applications, mobile apps, and appliances that bundle their own copy and need a rebuild to pick up 3.50.2.

CVE-2026-39210 to -39218: 21 FFmpeg zero-days for the price of a laptop

In June 2026, the AI lab depthfirst reported that its autonomous agent had scanned roughly 1.5 million lines of FFmpeg C code and produced 21 confirmed zero-days, at a run cost of about US$1,000. Nine have CVE identifiers so far, CVE-2026-39210 through CVE-2026-39218, and the rest are fixed upstream while awaiting numbering (depthfirst, 2026). The bugs are mostly heap or stack overflows in parsers and demuxers, spanning the TS demuxer, the VP9 decoder, the RTP depacketizer, and more, with one stack overflow in service-description-table handling that had sat untouched since 2003 (The Hacker News, 2026). These NVD records are reserved as of this pass, so their individual CVSS scores are still pending, and this tracker will not guess them.

The patch guidance is blunt. Pull the fixed upstream FFmpeg build or your distribution's security update as soon as it lands, and remember that embedded copies of FFmpeg inside media pipelines, transcoders, and device firmware need patching too. Prioritize anything that ingests untrusted RTSP or AV1-over-RTP, which is where the most serious of these live. The strategic lesson is that a US$1,000 agent run can now sweep a dependency that decades of manual review and fuzzing had not fully cleared.

CVE-2026-28952: Apple names the model in the credit

Apple's macOS Tahoe 26.5 advisory credits Calif.io, in collaboration with Claude and Anthropic Research, for an integer overflow that a malicious app could use to cause unexpected system termination (Apple, 2026). NVD lists a CVSS 3.1 base score of 7.5 and confirms the fix shipped across macOS Tahoe 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and iOS and iPadOS 18.7.9 (NVD, CVE-2026-28952). This is the AI-assisted bucket in its clearest form. A research firm used the model as part of its workflow, and the vendor's acknowledgement names both the firm and the AI, rather than pretending either did it alone.

The patch action is simple and should already be in your fleet management queue: update to the fixed Apple OS builds. The wider signal is that a mainstream vendor's security acknowledgements now list an AI collaborator by name, which normalizes AI-assisted research as a standard, creditable method rather than a novelty.

CVE-2026-45185: the Exim RCE a human had to finish

The Exim "Dead.Letter" flaw is a remotely reachable use-after-free (CWE-416) in the BDAT body-parsing path, affecting Exim builds from 4.97 up to 4.99.2 that use GnuTLS, fixed in 4.99.3. NVD scores it 9.8 under CVSS 3.1, an unauthenticated network attacker path to arbitrary code execution (NVD, CVE-2026-45185). It reached the tracker as a hybrid, not an autonomous find, and the reason is instructive. XBOW's platform surfaced the bug, but turning it into a working exploit became a seven-day contest between XBOW's own automated system and a human researcher assisted by a model. The human, Federico Kirschbaum, won, and XBOW's takeaway was that models alone are not yet ready to write real-world exploits (XBOW, 2026).

Patch action: upgrade Exim to 4.99.3. Builds compiled against OpenSSL rather than GnuTLS are not affected, but given Exim's share of internet mail, GnuTLS builds should be treated as urgent. The credit nuance is the point of the entry. Even when an AI platform gets you to the doorstep of a critical bug, the hardest, highest-consequence step still favored a human this year.

What did not make the tracker, and why

Accuracy means saying no as often as yes. The most common pairing we were asked about was Kimi K3 and Redis. It is not in the table for two independent reasons. First, the Redis advisory CVEs that circulate alongside that story are credited to human researchers, not to an AI model. Second, the separate, widely shared claim that Kimi K3 found a Redis issue in minutes has no CVE assigned to it, so it fails the tracker's basic bar of a real identifier with a verifiable finder. A model doing something impressive in a demo is not the same as an AI holding a credit on a numbered, fixed vulnerability, and this tracker only records the latter. If a Redis CVE is later credited to an autonomous agent, it earns a row then, not before.

What this means for defenders

The through-line of the 2026 record is not that AI replaced human researchers. It is that the discovery side of the industry now runs at a cadence and cost that point-in-time defense was never designed for. When an agent can sweep a dependency for zero-days at the price of a laptop, the question is not whether your annual pentest was thorough. It is what has changed in the eleven months since it finished. Our take on that shift, and how an autonomous attacker actually operates, is laid out in Inside Agentic Red Teaming and in our read of the AI offensive security tool boom.

For teams turning this into a plan, three moves follow directly from the tracker:

• Match the attacker's cadence with continuous validation. The classes AI is strongest at, mature libraries and internet-facing services, are exactly the ones that drift between annual tests. Testing continuously is how you close the gap between disclosure and detection.

• Route the work to the right tester by vulnerability class. The complex web application and API authorization layer, where broken access control, IDOR, and business-logic flaws live, is where Stingrai's Snipe operates as an autonomous agent, trained to hunt exactly those high-impact classes rather than stopping at known-class noise. The datastore, media library, mail server, and OS kernel classes on this tracker, the SQLite, FFmpeg, Exim, and macOS style bugs, route to senior human pentesters through our network and infrastructure testing and red teaming practices. Getting that split right is the same discipline as getting the credit bucket right.

• Keep humans on the last mile. The Exim entry is the proof. Even a strong AI platform needed a human to finish the hardest, highest-consequence work, which is precisely the model behind an effective hybrid program. For the evidence on where autonomous tools land today, see our AI pentest benchmark results and our note on the acceptable false-positive rate for autonomous pentesting.

Stingrai is a CREST-accredited penetration testing service provider, based in Canada, that tracks the AI-attacker era as a working reality rather than a forecast. Our hybrid model pairs autonomous coverage with senior human validation, and the resulting reports give you the pentest evidence that supports your SOC 2 and ISO 27001 programs. Scope and packages are on our pricing page.

Frequently asked questions

Which real CVEs did AI discover in 2026?

At least five verified records carry an AI finder credit across 2025 and 2026: the Microsoft Devices Pricing Program RCE CVE-2026-21536 (XBOW, autonomous), the SQLite flaw CVE-2025-6965 (Google Big Sleep, autonomous), the FFmpeg cluster CVE-2026-39210 through CVE-2026-39218 (depthfirst, autonomous), the Apple macOS flaw CVE-2026-28952 (Calif.io with Claude and Anthropic Research, AI-assisted), and the Exim RCE CVE-2026-45185 (surfaced by XBOW, exploit written by a human, so hybrid). All five are patched.

What is the highest-severity CVE credited to an AI in 2026?

CVE-2026-21536, a remote code execution flaw in the Microsoft Devices Pricing Program, carries a CVSS 3.1 base score of 9.8 and was credited to the autonomous agent XBOW (NVD). The Exim RCE CVE-2026-45185 also scores 9.8, but it is logged as a hybrid find rather than a fully autonomous one.

Did an AI agent really find a bug that had existed for 23 years?

Yes. Among the 21 FFmpeg zero-days that depthfirst's agent reported in June 2026, one stack overflow in service-description-table handling dated to 2003 and had gone undisclosed for roughly 23 years (The Hacker News, 2026). It is a clear example of agents finding value in mature code where manual review had moved on.

What is the difference between an autonomous AI find and an AI-assisted find?

An autonomous find means an agent drove the discovery end to end, with a human only triaging before disclosure, as with XBOW on Microsoft or Big Sleep on SQLite. An AI-assisted find means a human researcher used a model as a tool and is credited alongside it, as with the Apple macOS entry. A hybrid, like the Exim RCE, is where a platform surfaces the bug but a human completes the exploit. The three are different threat claims and should not be merged.

Why is the Kimi K3 and Redis finding not in the tracker?

Because the attribution does not meet the bar. The Redis advisory CVEs that circulate with that story are credited to human researchers, not to an AI model, and the separate claim that Kimi K3 found a Redis issue quickly has no CVE assigned to it. The tracker only records numbered, fixed vulnerabilities with a verifiable finder, so this pairing does not qualify yet.

Are all of these AI-attributed CVEs patched?

Yes. Every entry points to a fixed version or a server-side mitigation: Microsoft mitigated CVE-2026-21536 in its cloud, Exim fixed CVE-2026-45185 in 4.99.3, SQLite fixed CVE-2025-6965 in 3.50.2, the FFmpeg cluster is fixed upstream, and Apple shipped fixes for CVE-2026-28952 across macOS, iOS, and iPadOS. This is a patch-status reference, not an open-threat feed.

Does an AI-found CVE mean AI can now replace human pentesters?

No. The 2026 record shows autonomous agents reaching real severity, but the hardest last mile still favored humans. XBOW concluded that models alone are not yet ready to write real-world exploits, which is why the Exim RCE went to a human (XBOW, 2026). The effective model is hybrid: autonomous breadth plus senior human validation, which is how Stingrai runs its testing.

Where can I get the latest AI-attributed CVE data?

Track the primary advisories directly: NVD for per-CVE detail, vendor advisories from Apple and Microsoft, and lab and vendor write-ups from Google Big Sleep, XBOW, and depthfirst. All of them are linked in the references below, and this tracker is refreshed as new dated, verifiable AI-attributed CVEs publish.

References

1. Apple. About the security content of macOS Tahoe 26.5. May 2026. https://support.apple.com/en-us/127115. Vendor advisory listing CVE-2026-28952 and its credit to Calif.io in collaboration with Claude and Anthropic Research.

2. NVD (NIST). CVE-2026-28952. 2026. https://nvd.nist.gov/vuln/detail/CVE-2026-28952. Integer overflow, CVSS 3.1 base 7.5, fixed across macOS, iOS, and iPadOS builds.

3. XBOW. Three RCE vulnerabilities in Microsoft identified by XBOW. March 2026. https://xbow.com/blog/three-rce-vulnerabilities-in-microsoft-identified-xbow. Vendor write-up on the autonomous discovery of the Microsoft RCE cluster.

4. Krebs on Security. Microsoft Patch Tuesday, March 2026 Edition. March 2026. https://krebsonsecurity.com/2026/03/microsoft-patch-tuesday-march-2026-edition/. Independent coverage of the March 2026 bulletin, including CVE-2026-21536.

5. NVD (NIST). CVE-2026-21536. 2026. https://nvd.nist.gov/vuln/detail/CVE-2026-21536. Unrestricted file upload (CWE-434), CVSS 3.1 base 9.8, Microsoft Devices Pricing Program.

6. Google Cloud. Cloud CISO Perspectives: our Big Sleep agent makes a big leap. 2025. https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-our-big-sleep-agent-makes-big-leap. Google's account of Big Sleep finding SQLite CVE-2025-6965 and foiling an in-the-wild exploit.

7. NVD (NIST). CVE-2025-6965. 2025. https://nvd.nist.gov/vuln/detail/CVE-2025-6965. SQLite memory corruption before 3.50.2, CVSS 3.1 base 7.7 and CVSS 4.0 base 7.2.

8. depthfirst. 21 Zero-Days in FFmpeg. June 2026. https://depthfirst.com/research/21-zero-days-in-ffmpeg. Research write-up on an autonomous agent finding 21 FFmpeg zero-days for roughly US$1,000.

9. The Hacker News. AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs. June 2026. https://thehackernews.com/2026/06/ai-agent-uncovers-21-zero-days-in.html. Coverage confirming the CVE-2026-39210 through -39218 range and the 2003-era stack overflow.

10. NVD (NIST). CVE-2026-39210. 2026. https://nvd.nist.gov/vuln/detail/CVE-2026-39210. Reserved entry heading the FFmpeg cluster; per-CVE severities pending NVD analysis.

11. XBOW. Dead.Letter: how XBOW found an unauthenticated RCE on Exim. May 2026. https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim. Vendor write-up describing the platform-surfaced, human-completed Exim exploit.

12. NVD (NIST). CVE-2026-45185. 2026. https://nvd.nist.gov/vuln/detail/CVE-2026-45185. Exim use-after-free (CWE-416) in the BDAT path on GnuTLS builds, CVSS 3.1 base 9.8, fixed in 4.99.3.

13. The Hacker News. New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution. May 2026. https://thehackernews.com/2026/05/new-exim-bdat-vulnerability-exposes.html. Independent coverage of CVE-2026-45185 and the human-versus-model exploit race.