Security fixes are being bypassed more often in 2026, according to AI penetration-testing startup Terra Security, whose findings The Register reported Monday, Oct. 19. Terra reviewed every published CVE record and GitHub-reviewed advisory looking for broken fixes and found a pattern that had been rare for six years: “A fix would ship, a bypass would be found, and another fix would go out.”

From 2019 through 2025, about 0.2% of GitHub security fixes needed a follow-up advisory reporting a failed patch within 90 days. In 2026 that share jumped to 2.3%. Vulnerabilities whose fixes were later bypassed were also about four times as likely to land on CISA’s Known Exploited Vulnerabilities list as other bugs from the same vendors, Terra said. The Register tied the rise to this year’s boom in AI-driven vulnerability discovery and patching.

One example: Russian government spies exploited a Windows Shell security bypass, CVE-2026-21510, at least a month before Microsoft patched it in February.…