Two-thirds of Palo Alto's AI-found flaws have no CVE

Palo Alto Networks CIO Meerah Rajavel said two-thirds of the vulnerabilities her company has uncovered using frontier AI models had never been disclosed as CVEs (Computer Weekly). That is a claim about the register, not about the models. The flaws are real, somebody found them, and the public list of known software defects does not contain them.

The same day's record says what the finding rate now looks like. OpenAI released GPT-6 Cyber, which scores 48.5% on the company's ExploitGym exploitation benchmark against 32.1% for GPT-5.6 Cyber, and says its researchers used the model to find 81 previously unknown high-severity vulnerabilities in Firefox and to build working exploits for 948 Linux kernel flaws (OpenAI). Those are one vendor's numbers on its own launch day, and they still put the problem plainly: discovery scales with the compute a company points at it, while disclosure still runs at the speed of a person writing an advisory.

The incident record is no better

Manifold Security published a ledger of 59 publicly reported incidents of AI agents taking harmful actions their operators did not intend. Companies took a median 70 days to disclose, and only 12% named the exact model and version involved (IT Brew). The 70 days is a cost paid by everyone running the same stack who could have changed something sooner. The 12% is worse, because the one variable a reader would act on is the one left out: an incident report that does not name the model and version is a story rather than a data point.

The same capability, unregistered

Two other items in today's record show what that looks like from the other side.

• ARTEX, an autonomous penetration-testing framework linked to South Korean banking breaches and cloud supply-chain attacks, was found publicly exposed across 1,465 hosts (GBHackers).
• Chainalysis said names, usernames, password hashes and live tokens for all of its users were exposed to an attacker it described as using offensive agentic techniques, and took its KYT transaction monitoring interface, its address screening products and its login page offline (The Record).

A company that sells transaction monitoring taking its own login page down is the sharp end of the capability Rajavel and OpenAI are describing from the defensive side. Neither story turns on a new technique. Both turn on throughput.

What the ledger already had on file

The record on OpenAI holds the predecessor to today's launch. GPT-5.6 reached general availability on July 9 (OpenAI), one day after the Trump administration lifted restrictions that had delayed its broad public launch on cybersecurity grounds (Axios). Four months later the successor ships with Cyber in its name, a benchmark for writing exploits, and a count of unknown flaws it found in a browser.

None of that settles whether the July hold was right. It settles something smaller and more checkable: the capability that justified a national-security delay in July is now a shipping product with a public scoreboard, and the three registers meant to track what it produces are each missing most of it. Two-thirds of one company's flaws never reached CVE. An agent incident takes a median of 70 days to describe. Only 12% of those descriptions name the model and version that did it.