It's both, really. AI is identifying vulns, writing exploits, and also generating new vulns at the same time.

100% this. Their update stability has gotten even worse, I didn't think that was possible.

It would actually be interesting to see the distribution of patches over the age of the code it was applied to.