No, the vulnerabilities were always there, AI is just pointing them out publicly.

I used to work as a professional hacker. Let me tell you something that the news never, ever talks about: If a company doesn't have a bug bounty program, we kept those vulnerabilities to ourselves.

A government has vast resources to do just that: Keep the vulnerabilities to themselves until they feel like using them. They will not disclose them. They will keep them in their back pocket until the day comes when they need them for an op.

The only time they disclose vulnerabilities is when they think they're too easy to find and there's a public interest benefit to getting the problem fixed (e.g. the government is using those products).

What this means is that AI really is making FOSS vastly more secure than it ever was. This is probably pissing off government red teams to no end.

What we're not hearing about as much is AI finding vulnerabilities in closed source products. Not because it's not finding them, but because the disclosures are kept private (because companies treat it as bad PR and they're assholes about it).

You can bet your ass that AIs run by state actors are building up massive war chests of vulnerabilities in closed source products right now. We'll only hear about them after these products get exploited and maybe not even then because so, so many companies have no idea WTF they're doing in regards to infosec. Think about it: How many CEOs are right now demanding their teams reduce the amount of FOSS they use because of the recent news? These people are idiots and apparently never heard that old joke about a new employee making a $100,000 mistake... "We just spent $100,000 training them!"