Discovery outpacing creation is doing a lot of work in that claim — AI audits code faster, but it also writes buggy code faster, so the net is an open race. The honest metric isn't CVE count, it's whether fixes land faster than new defects ship.