I'm a little late to the party on this one, but I still wanted to share and comment on Google's recent findings on vulnerability/exploitation trends. The article is a bit lengthy (~17 min read) but it's a good read. Check it out here.

My takeaways (most of which aren't particularly surprising):

-- Vulnerabilities targeting the AI operational stack are heavily concentrated in orchestration and agent frameworks (e.g., Langflow, LangChain, AutoGen). This layer accounts for 50% of all AI-related flaws disclosed in 2026.

-- The one that did catch my eye: half of all AI-discovered vulnerabilities lead to remote code execution, compared to roughly a quarter across the broader CVE ecosystem. AI isn't just finding more bugs, it's finding more serious ones.

-- With discovery and exploitation both accelerating, the article argues for a fundamental shift in defensive strategy, which I'd boil down to:

1) Intelligence-driven triage
2) AI-enhanced code review
3) Automated remediation

While I respect the strategy here, I think these are delicate matters (particularly the third) and shouldn't be implemented haphazardly. Ironically, the same report finds agent frameworks are the most vulnerable layer of the AI stack, so giving an agent write access to patch production deserves the same scrutiny as any other privileged tool.