Microsoft's patch volume jumped from dozens to 600+ a month in July

Microsoft shipped more than 600 security patches in July, up from a typical 60 to 90 a month over the prior year, according to an analysis by technology columnist Rupert Goodwins. Oracle and the Linux kernel are seeing similar jumps in patch volume.

Goodwins attributes the spike to two AI-driven mechanisms working at once. First, AI code-analysis tools are systematically surfacing vulnerabilities that sat undiscovered in legacy codebases for years, bugs a human reviewer would likely never have gone looking for. Second, AI-generated production code is shipping at variable quality, and some of what it introduces needs fixing shortly after it lands.

Both mechanisms cut the same direction: more patches, faster, and less time between a bug's introduction and its discovery. That's a genuine shift for a small team leaning on coding agents for a meaningful share of implementation. Old assumptions about review load, how much a human reviewer can realistically catch by skimming a diff, get harder to hold onto when an agent can both write the flawed line and, a version or two later, find and fix it faster than most manual review cycles run.

Goodwins is clear this is analysis, not a peer-reviewed study: the patch counts are real and verifiable, but how the trend plays out over time isn't yet well understood. For teams shipping AI-assisted code today, the practical takeaway is narrower and more immediate: automated, mechanically-checkable verification (tests, security scans, regression checks) is doing more of the work that a careful human reviewer used to do alone, and it's worth treating that shift as already underway rather than waiting for the research to catch up.