The cybersecurity establishment has been sounding alarms about AI-powered attacks for months, but new research from SemiAnalysis suggests the predicted crisis hasn't materialized yet. While AI coding models like Claude Code have become increasingly capable at finding and exploiting vulnerabilities, the actual number of security flaws discovered in critical software remains largely unchanged compared to pre-AI baselines. The disconnect between hype and reality reveals an important truth about how technology adoption actually works in practice.

When OpenAI, Anthropic, and other frontier AI labs began publishing research on AI-assisted vulnerability discovery through initiatives like Project Glasswing and Daybreak, the narrative became clear: artificial intelligence had fundamentally altered the tempo of cybersecurity. Models trained on vast amounts of code could now identify zero-day vulnerabilities at machine speed. Security researchers and company executives warned that the status quo would no longer suffice. Yet when SemiAnalysis examined the data, the story became far more nuanced.

What Does the Data Actually Show About AI and Cybersecurity?

SemiAnalysis conducted extensive testing across the software stack that powers modern AI infrastructure, examining vulnerability disclosures in critical tools including the Nvidia GPU driver, CUDA, PyTorch, Kubernetes, and Docker. The researchers tracked Common Vulnerabilities and Exposures (CVEs), which are publicly disclosed security flaws, across multiple quarters to see whether AI coding tools had accelerated the discovery process. The results were surprising: in most cases, there was no statistically significant change in the rate of vulnerability discovery.

The Linux kernel presented another interesting case study. Linus Torvalds, the kernel's creator, publicly expressed optimism about AI tools, stating that he was "willing to absolutely put [his] foot down as the top-level maintainer" in support of using AI as a development tool. Despite this endorsement and the kernel's massive codebase, the number of security patches remained relatively stable. August 2026 marked the kernel's most prolific month since becoming an independent CVE Numbering Authority, but June 2026, which coincided with peak AI cybersecurity discourse, sat around the historical median.

One notable exception did emerge from the data. Organizations participating in Project Glasswing, Anthropic's security research initiative, showed a statistically significant year-over-year surge in reported bug fixes compared to control organizations. However, researchers noted an important caveat: members of this elite group have incentives to publicize large numbers of bug fixes as a way of demonstrating their cutting-edge capabilities and inclusion in a prestigious program. This creates potential bias in the data.

Where AI Is Actually Making a Measurable Impact on Security?

While the broader software ecosystem showed minimal change, one area did reveal clear growth: Nvidia and AMD's AI infrastructure stacks. Since capable AI coding models became widely available, the number of vulnerabilities discovered in these specialized libraries has increased noticeably. This makes intuitive sense, as AI developers represent the most aggressive early adopters of AI coding tools and spend considerable time working within these specific ecosystems.

The gap between perception and reality highlights a critical challenge in the AI era: distinguishing between genuine technological shifts and marketing narratives. SemiAnalysis researchers acknowledged that they initially expected to find dramatic statistics about AI agents discovering vulnerabilities at unprecedented rates. Modern AI models are saturating increasingly difficult coding benchmarks, and open-source models such as Kimi K3, GLM-5.2, DeepSeek V4, Qwen 3.8, MiMo V2.5, MiniMax M3, Nemotron, and Gemma are rising in security benchmarks like Cybench and Cyberseceval 3.

How Organizations Can Assess Their Own Security Posture

For companies concerned about their infrastructure security in an AI-driven world, SemiAnalysis has released practical tools and guidance. The research team developed ClusterMAX 3.0, a comprehensive testing framework that evaluates infrastructure security across multiple dimensions. Organizations can take several concrete steps to evaluate and improve their security stance:

• Run Automated Audits: Install the latest version of ClusterMAX CLI and execute the security audit command to automatically detect vulnerabilities in Slurm clusters, Kubernetes clusters, standalone virtual machines, bare-metal machines, and containers against baseline software versions with known security issues.
• Implement Multi-Phase Testing: Move beyond basic audits to conduct performance and reliability testing, which involves dozens of benchmarks and simulated hardware failures that stress compute, networking, storage, monitoring systems, and health checks individually.
• Evaluate Vendor Security Architecture: Conduct interviews with infrastructure providers to understand their decisions regarding orchestration software, operating system provisioning, firmware management, networking, and storage security practices.

The ClusterMAX testing framework covers three distinct phases: audit, performance, and reliability. Running an audit typically takes a few minutes, while complete performance testing requires several hours and reliability testing can take multiple days, with a minimum of four nodes required for full evaluation.

SemiAnalysis researchers emphasized an important caveat about their findings: it remains early in the AI era, and dramatic statistics about AI-powered cybersecurity threats may yet emerge. Security researchers have reported qualitative changes in their work, and significant defensive work is happening behind closed doors that cannot be immediately disclosed. The researchers urged readers to examine the data independently rather than accepting prevailing narratives at face value.

The broader lesson extends beyond cybersecurity: as AI tools become embedded in critical infrastructure, distinguishing between genuine technological shifts and promotional messaging becomes increasingly important. While Claude Code and similar AI coding assistants are undoubtedly powerful tools for developers, their impact on real-world security outcomes appears more measured than the headlines suggest. Organizations should remain vigilant about security practices while avoiding panic-driven decision-making based on speculative threats.