AI cuts time needed to find software flaws
New incidents show that artificial intelligence can detect vulnerabilities faster, while organisations do not always respond as quickly.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Artificial intelligence is speeding up the search for software vulnerabilities, increasing pressure on companies and governments. Dutch and international security sources warn that attackers and researchers can work ever faster.
The National Cyber Security Centre (NCSC) writes in the Cybersecuritybeeld 2026 that malicious actors are demonstrably using AI at every stage of cyber attacks. As a result, the NCSC says, attacks can be carried out more quickly and on a larger scale. The centre describes the development as a structural change in the digital threat landscape, not as a single incident.
A recent example from the United Kingdom shows how short the response time can sometimes be. According to ITPro, researchers found vulnerabilities and leaked login credentials in public code environments belonging to British government organisations. ITPro reported that a problem at the UK Planning Inspectorate was fixed within twenty minutes of being reported. The researchers also reported other access problems, including an error in a procurement system and a leaked API token.
That example does not mean that AI was the cause of every vulnerability found. The researchers used AI to identify problems more quickly, while the underlying errors were often ordinary configuration or access issues, according to the report. The distinction matters: AI can speed up discovery, but in itself says nothing about the quality of the software or whether data were actually stolen.
The NCSC also warned this week that companies must get their digital security in order. For small businesses, the Mijn Cyberweerbare Zaak subsidy scheme runs until 30 November 2026, according to the centre. That is a policy measure, not evidence that every company is currently threatened by an AI attack.
The development increases the value of rapid patching, strong access controls and revoking leaked keys. At the same time, it remains unclear how often AI actually leads to successful data theft. The public sources mainly describe a faster-moving threat and individual incidents; they do not provide a uniform global count of data breaches caused by AI.
Also show where in Europe and in the world
One story, several perspectives
What is established
- The NCSC reports that AI is used at various stages of cyber attacks.
- AI can help find software vulnerabilities more quickly.
- Vulnerabilities found more quickly increase pressure on organisations to patch rapidly.
- Not every vulnerability found with AI leads to a data breach.
Left
Arguments Governments and companies should treat digital security as public infrastructure and invest sufficiently in oversight, staff and secure standards.
Values Collective security, protecting citizens and the responsibility of powerful technology companies.
Consequences More rules and public capacity could reduce risks, but require additional funding and could slow innovation.
Centre
Arguments The best approach combines rapid reporting, proportionate oversight and cooperation between government, researchers and companies.
Values Balance, practicality and institutional reliability.
Consequences Cooperation can shorten response times without placing all responsibility on one party.
Right
Arguments Organisations that use digital systems should remain responsible for basic security themselves; innovation should not be held back by broad new rules.
Values Individual responsibility, entrepreneurship and technological freedom.
Consequences Fewer rules may support innovation, but could leave vulnerable organisations and users with unequal protection.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The text distinguishes AI-assisted detection from proven AI-caused data theft. The current warnings and the British example are linked to public sources.
- confirmed The NCSC says that malicious actors use AI at every stage of cyber attacks. — This is stated in the Cybersecuritybeeld 2026. source
- confirmed A British government vulnerability was resolved within twenty minutes, according to ITPro. — ITPro quotes the organisation involved on this point. source
- confirmed The sources used contain no uniform global count of data breaches caused by AI. — The cited sources describe individual incidents and threat analyses, not a complete global dataset. source
Editor's note
The acceleration of vulnerability discovery is well supported; the sources provide no complete figure for the number of data breaches caused by AI.Sources
More on this in Dutch media
- AD — „kunstmatige intelligentie”
- RTL Nieuws — „kunstmatige intelligentie”
- FD — „kunstmatige intelligentie”