The patches will not stop
Your computer needs another update. It always needs another update. The notifications are relentless. This week felt different. It was different. On Tuesday, Microsoft released a list of urgent software repairs that broke its own records. Again. The official number was 974 Common Vulnerabilities and Exposures, the largest single ‘Patch Tuesday’ in the company’s history. Adobe also brought its own urgent fixes to the party. Each of those 974 items represents a specific, documented security hole in the software that runs on billions of devices, a potential entryway for criminals or state actors. This was not a routine clean up. It was a deluge. And it was the third record broken in just a few months.
This frantic pace is new. It is alien. For years, the work of securing major software products followed a predictable human rhythm, with engineers at companies like Microsoft enjoying a quieter summer to take holidays and spend time with their families. The big pushes were saved for the autumn. That calendar is gone. This summer was different. Sources inside the technology giant confirm the season was unusually busy, a frantic scramble for security and Windows engineers who had expected a period of calm. They lost their quiet summer. The old, steady tempo of maintenance and repair has been completely shattered.
The two facts are connected. The record breaking number of fixes is the direct result of a new and relentless pressure that has erased the industry's traditional downtime, a process that truly began in April. That was when new tools started finding security weaknesses in almost every major operating system and web browser at a rate that human teams simply could not match. What was once a manageable flow of bugs identified by researchers has become a firehose that cannot be turned off. The era of the quiet summer is over. The age of the constant patch has begun.
Meet the new bug hunters
The bug hunters are not human. They are artificial intelligence models. Very specific models. In April, a model from the company Anthropic called Mythos began systematically finding security vulnerabilities in almost every major operating system and web browser. It was a machine. It was relentless. This is not the work of a person, or even a large team of people, sitting in a dark room typing code to break into a system. The agent of this new chaos is an algorithm. A piece of software.
This is not the plot of a film. The machines have not woken up. These AI systems are better understood as a new kind of industrial tool, trained on immense libraries of existing computer code which include countless examples of known historical security flaws. The models learn to analyse new software and recognise the digital fingerprints of a potential vulnerability, spotting patterns that a human eye might easily miss or simply lack the time to find. It is tireless pattern recognition. At an impossible scale. The AI does not need to understand what it is looking at in any human sense. It just needs to find a statistical match between the code it is analysing and the library of errors it has memorised.
A human security researcher develops intuition. They might specialise in a particular area of code and hunt for entirely novel types of errors using creativity and insight. It is a slow process. A careful one. The AI is different. It is a powerful assistant that excels at finding subtle mistakes and variations of known bug classes across vast, sprawling codebases at a speed that is simply not human. It does not get bored. It does not need to sleep. A few weeks after Anthropic’s April breakthrough, OpenAI released its own cybersecurity focused model to trusted partners, accelerating the new trend. The biggest players in AI were now competing to build the best bug finder.
The effect is an industrialisation of bug discovery. The craft is gone. What was once the work of specialist human teams is now an automated process operating at machine speed, with the output being not a finished product but an endless list of documented software errors. Microsoft is not alone. Every major technology firm now finds itself on the receiving end of this high speed audit, forcing their own engineers into a reactive, constant state of repair. The process will not stop. It cannot be negotiated with. It just finds flaws.
An arms race in machine time
The defenders have new tools. The immediate benefit goes to companies like Microsoft and Adobe, who can use models like Anthropic's Mythos to find flaws before hostile actors do. It allows them to get ahead. For a moment. But the tools will not stay secret. They will not stay exclusive. The science behind them is public knowledge, and the immense computing power they require is a commodity that can be bought or rented. This means criminal organisations and state sponsored hacking groups will inevitably develop their own versions, if they have not already. It signals the true start of a cybersecurity arms race fought in machine time.
This is the new conflict. The stakes are immense. It is a battle of discovery and exploitation, played out not in months or weeks but in the hours between an AI finding a bug and a company shipping a patch. Imagine a criminal syndicate with a model as powerful as the one OpenAI gave its partners after the April revelations. They would not find one vulnerability. They would find thousands. Their AI could then automatically generate exploit code, test it, and deploy it against targets across the globe before a single human engineer at Microsoft even sips their morning coffee. Exploitation could become a fully automated, industrial process.
For now, the advantage seems to be with the defenders. Anthropic's public disclosure of its work in April was a warning shot, and Microsoft is clearly using similar technology to generate huge updates like the patch release on 9 September. That is the public face. The race is elsewhere. State intelligence agencies will be pouring billions into developing their own models, not to help Adobe secure its software, but to find flaws they can use for espionage and sabotage. The same logic applies to organised crime, which can now treat vulnerability discovery not as a high skill human endeavour but as a scalable business with predictable returns. The prize is access to everything.
The old rhythm is gone. A clever researcher would find a flaw, report it, and engineers would work for weeks to fix it. That timeline is now compressed to almost nothing. The problem is the human. Microsoft might receive a list of a thousand new bugs from its AI on a Monday, but it still takes people time to analyse the severity of each one, write a stable patch, and test it. That process is the period of maximum danger. It is the window during which an attacker with the same knowledge can strike, knowing the defenders are scrambling to bolt the door. Each of the 974 flaws fixed in September represented a door into a system, found by a machine, needing to be fixed by a person before another machine got there first.
The price of constant repair
Someone has to pay the price. The first bill landed with the software engineers at Microsoft. They lost their summer. The Verge reported that the season, usually a quiet period reserved for family holidays and time away from the screen, instead became an unusually busy and frantic effort to keep up. It was a scramble to fix the endless stream of vulnerabilities being found by new AI models. This was not a one off. It is the new cost of doing business, and the price is being paid in cancelled leave and marathon coding sessions just to stand still.
That strain does not stop at Microsoft's campus in Redmond, Washington. For every huge patch released, like the record breaking one on 9 September, the work is only just beginning for thousands of other teams. A critical update for Windows is not the end of a problem. It is the start of one. Every hospital, university, and private company in the country now has a new, urgent task on its to do list. The update from Microsoft contained 974 separate fixes. A system administrator at a council office in Cardiff cannot just click 'update all' and hope for the best, because a single flawed patch could cripple council tax collection or shut down social care scheduling systems.
The work is immense. The risk is higher. Every single one of those hundreds of patches must be evaluated for relevance and then tested on non critical systems to ensure it does not break some other essential piece of software. It is a slow, painstaking process. This relentless cycle of emergency creates a perfect environment for human error. Burnout is the inevitable result. IT professionals, already stretched, are now in a permanent state of high alert, responding to a flood that never recedes because the AI discovery tools never sleep. An exhausted person might approve a critical update without conducting sufficient testing. They could misconfigure a security setting while rushing to deploy a fix against an active threat.
This all costs money. A lot of money. Businesses must now absorb the significant cost of increased staff hours to manage the flood. They must also fund more complex and expensive testing environments to check every patch safely. This also means accepting the financial hit from downtime, a disruption caused both by the original vulnerabilities and, occasionally, by the very fixes designed to solve them. Security is no longer a scheduled activity. It has become a constant, expensive war of attrition fought by people who are running out of sleep.
So are we safer yet?
Are we actually safer? Finding a vulnerability is always better than leaving it undiscovered, a digital landmine waiting for an attacker to step on it. This is progress. Or it should be. The danger now comes from the volume, a constant barrage of alerts and fixes that threatens to overwhelm the human teams tasked with keeping systems secure, turning a necessary process of maintenance into a source of profound risk. It is called patch fatigue. When a system administrator receives another ‘critical’ alert, the word itself starts to lose its meaning, the digital equivalent of the boy who cried wolf, except the wolf is always at the door and the shepherd is exhausted.
This flood of fixes creates noise. A single, devastating vulnerability, the kind that could bring down a hospital’s patient records system or freeze a nation’s banking network, is now hidden within a haystack of hundreds of other less severe, but still important, security fixes announced on the same day. Anthropic’s Mythos model started this in April. The patches have not stopped since. This new speed of discovery means hundreds of security holes are revealed simultaneously, forcing defenders to prioritise in a state of permanent crisis. The assumption must be that hostile actors, whether state sponsored groups or criminal gangs, are developing similar AI capabilities. They hunt for the same flaws. They do not report them. They exploit them.
The result is a dangerous transitional period, a chaotic race where defenders, already exhausted from patching the 974 vulnerabilities Microsoft announced in September, must also guard against an unknown number of equally serious flaws found by an adversary’s AI and exploited before a fix is even possible. The risk profile has shifted. Previously, the greatest danger was the flaw no one had ever found. Today, the greatest danger might be the flaw that has a patch available but which gets lost in the sheer, overwhelming noise of a thousand other fixes before it can be installed.
Eventually, this era of machine led bug hunting might lead to fundamentally more secure software, as developers learn to build code that can withstand AI scrutiny from the very start. That future is not here. For now, the system is more volatile. The discovery of more flaws has, paradoxically, created more opportunities for attack. The ultimate line of defence is not an algorithm. It is the human operator who must decide which patch to deploy first. That person is tired. That person is under pressure. And the new AI bug hunters have just made their job immeasurably harder.
Sources. The Register: Microsoft breaks Patch Tuesday record with 974-CVE deluge. The Verge: Microsoft breaks another patch Tuesday record.
Analysis. Drafted with AI assistance from the sources listed above and reviewed by an editor before publication. Jnews links to the organisations it writes about.
