vulnerability
A vulnerability is a flaw or weak point in software, a device or an AI system that an attacker can exploit to do something they are not authorized to do.
In plain terms
Imagine you have a window in your apartment with a faulty lock. As long as no one notices, nothing happens, but the possibility exists: whoever knows about it can enter through it. A vulnerability is exactly such a poorly locking window in a program, phone, website, or AI system.
A vulnerability is not an attack or damage in itself, only the possibility of one. It is important to know about it because if found and fixed before a malicious actor discovers it, trouble can be prevented. This is what security updates are for, which your phone and computer regularly request.
With AI agents, the concept expands. Here, not only the program code can be faulty; the operating principle itself can be attacked: the agent follows text instructions, so a sentence hidden in a web page or email can get it to do something other than what you asked.
How it works
- Origin: a weakness is born from a design flaw, programming error, poor configuration, or outdated component, often going unnoticed by anyone.
- Discovery: someone finds it. It could be the manufacturer, an independent security researcher, an automated scanning tool, a bug-hunting AI agent, or, in the worst case, an attacker.
- Disclosure and registration: the good-faith discoverer informs the manufacturer. Publicly disclosed vulnerabilities typically receive a unique identifier (CVE number) and a severity score (for example, CVSS score) so that everyone is talking about the same thing.
- Fix: the manufacturer releases a security update (a fix package, or patch). The bug does not disappear on your end: it only goes away once you install the update.
- Exploitation: if the attacker is faster than the patch or update installation, they can steal data, take control, or disable the system through the vulnerability. Attackers sometimes exploit a flaw even when the manufacturer is unaware of it or no fix exists yet. This is called a zero-day vulnerability.
An everyday example
Your phone sends a notification in the evening that an important security update is available, and you tap the 'Later' button. The update would likely fix a known vulnerability, meaning while you delay, your device operates with a flaw that attackers may also know about.
Who is affected
A common misconception
Limits and risks
- No system is flawless: the goal is to quickly identify and fix weak points, as eliminating them entirely is impossible.
- Antivirus and firewalls do not protect against every vulnerability, especially those unknown even to the manufacturer.
- Unsupported, older devices and programs do not receive fixes, so known bugs within them remain open permanently.
- Certain weaknesses of AI agents, such as deception via hidden instructions, cannot be fixed with a single update, so do not grant them more permissions than necessary.
Similar, but not the same
- threat – A threat is whoever or whatever can cause harm (for example, a fraudster or a piece of malware), while a vulnerability is the weak point through which it can do so.
- exploit – An exploit is the specific method or program used to actually take advantage of a vulnerability. The vulnerability is the bad lock; the exploit is the fake key for it.
- programhiba (bug) – Not every program bug is a vulnerability: only one that enables security damage counts as such, not merely an annoying operational disturbance.
Related concepts
cybersecurity, information security, AI safety, risk management
exploit, threat, security update, attack surface, red teaming, jailbreak, data poisoning
A brief history
Software vulnerabilities are as old as computer networks: the 1988 Morris worm spread by exploiting such flaws. The US-based MITRE launched the CVE list in 1999, which since then has provided a standard identifier for publicly known vulnerabilities.
Where things stand
Vulnerability management is a basic everyday task in cybersecurity by the end of 2026. Under the EU Cyber Resilience Act, from September 11, 2026, manufacturers of digital products must report actively exploited vulnerabilities in their products to the authorities quickly, initially within 24 hours. AI shapes the field in two ways: agents speed up the discovery of flaws, while also introducing new weak points that are hard to fix.
In the news
- Munich event on 10–13 November could shape direction of Europe's semiconductor industryOct 30, 2026 · Ipar
- AI bug reports swamp maintainers as OpenAI offers advice and Firedancer sets a feeOct 27, 2026 · Code
- Flood of AI-found bugs: OpenAI outlines a five-stage disclosure planOct 19, 2026 · Code
- GitHub AI Scan now covers PHP in pull requests; Snyk agent turns vulnerabilities into PRsOct 19, 2026 · Code
- Coding benchmarks mismeasure ability, and even the best models fail, critics sayOct 12, 2026 · Code
- Google suspends open-source bug bounty programme after flood of AI-generated reportsOct 5, 2026 · Code
- Epic used AI to find security flaws that could expose patient health recordsOct 5, 2026 · Health
- Cursor adds Slack-connected team bots, deployment monitoring and PR vulnerability detectionSep 28, 2026 · Code
Also known as
vulnerability · vulnerability · security vulnerability · security flaw · gyenge pont · vulnerability · security flaw · CVE
Sources
- NIST Computer Security Resource Center – Glossary: vulnerability
- CVE Program – hivatalos oldal
- Wikipedia – Vulnerability (computer security)
This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.