A slope change in disclosure counts is a statement about what enters queues, not about what is happening to unpatched machines. That is the difficulty with the vulnerability result [2]. The series that moved hardest are the ones counting reports, and the series counting confirmed exploitation moved considerably less [5]. If you staff an advisory triage rota, the first number is the one that bills you. If you want to argue that the gap between disclosure and exploitation is closing, you need the second number, and METR's read of the CISA and VulnCheck catalogues does not hand it over [5].
The attribution inside the rise is messier than the headline suggests. On cURL and OpenSSL, most of the additional 2026 disclosures carry an AI marking [3]. On Firefox, Microsoft, the US NVD and OSV, AI credits are a small share of the increase [4]. So of the six vulnerability sources METR names, two have a legible mechanism and four rose for reasons the credit field does not explain [1]. Severity cuts the same way: METR reports that higher-severity categories generally accelerate less, though they still accelerate [6]. The growth is weighted toward the end of the distribution that consumes reviewer hours without producing an emergency.
What makes the finding worth anything is the control groups sitting next to it. METR assembled seven algorithmic-efficiency histories, including Gurobi mixed-integer programming, MIPLIB, Stockfish and the matrix-multiplication exponent [7]. Two of them, nanoGPT and CIFAR-10, already contain LLM-driven records, and none of the seven bends the way the vulnerability series does [8]. Mathematics sits in between: three named open problems from pre-existing lists were solved with AI help in 2026 [9], arXiv submissions have doubled in some areas in under a year [10], and METR itself calls the open-problem evidence weak and the domain hard to measure objectively [11]. One of the three domains produced a clear slope change [2]. A vendor claiming general acceleration now has to explain why the optimization benchmarks with dense histories and actual LLM contributions did not move.
The measurement deserves its own discount. METR says the data collection and analysis were performed by agents, that it audited the output, and that mistakes likely remain; the underlying material is in a repository built to be corrected and updated [12]. It also covers only public discoveries, and METR allows that labs may be making undisclosed ones internally [13]. Treat it as the best available public baseline rather than an instrument you would use to size a specific project's exposure.
For a defender, the useful shape of this is narrow and unglamorous. More items arrive in the same funnel, most of them below the severity line that justifies interrupting a release, and they arrive faster than any evidence that attackers have shortened their side of the clock [5][6]. That is a capacity problem in advisory handling and patch scheduling, and it is a different budget line from the one you would open if exploitation tempo had moved. The two get conflated constantly. This is the first public series that lets you keep them apart.
