An artificial intelligence tool has identified 84 security flaws in 5G network software, and 23 of those vulnerabilities remain unfixed. The findings, reported by Help Net Security, mark one of the clearest demonstrations yet that machine-driven code analysis can surface large volumes of defects in telecom software that underpins next-generation mobile networks.

The number matters for network operators and their suppliers. Nearly 28% of the flaws discovered — 23 out of 84 — still lack a patch. That ratio gives security teams a concrete sense of how much remediation debt a single AI-assisted audit can expose in 5G stack code.

What does an AI-driven audit change for operators?

Traditional penetration testing and manual code review scale poorly against modern telecom software. 5G stacks contain millions of lines of code across radio, core and management layers. An AI tool can sweep that surface far faster than human auditors.

For practitioners, the practical change is volume. A single automated pass produced 84 distinct findings in this case. Security teams now face a triage problem rather than a discovery problem: which of those flaws are exploitable, which are critical, and which of the 23 unfixed items sit in paths an attacker can reach.

The result also shifts accountability expectations. When a machine can reliably enumerate defects, operators can ask vendors harder questions about patching timelines and secure development practices.

Why unfixed 5G flaws carry weight

5G networks carry core signaling, authentication and user traffic. A flaw in the software controlling those functions is not equivalent to a bug in an ordinary enterprise application. The attack surface includes network functions that operators expose to roaming partners, enterprises and, in some architectures, the public internet.

Twenty-three unpatched vulnerabilities in that environment represent live risk. Operators running the affected software cannot close the gap themselves if fixes depend on vendor releases. They can mitigate through segmentation and monitoring while they wait.

The findings arrive as regulators sharpen their focus on telecom network security. The EU Cybersecurity Act and the GSMA's NESAS benchmark already push vendors toward audited, repeatable security processes. AI-assisted discovery strengthens that pressure, because it raises the baseline of what a competent audit is expected to find.

How should teams read the numbers?

Some context for scale. Eighty-four flaws in one software stack works out to more than three discoveries for every one that currently has no remedy. If a vendor patched at a steady rate, closing 23 outstanding items would require sustained engineering effort across multiple release cycles — not a single emergency update.

The Help Net Security report does not specify which vendors' software the tool examined, nor does it rank the flaws by severity. Readers should treat the headline figures as evidence of AI audit capability rather than a verdict on any particular supplier.

That distinction separates commercial reality from tool marketing. Vendors of AI security products will cite this kind of result as proof of value. The defensible claim is narrower: an AI tool found 84 flaws, and 23 remain open. Whether the tool's findings translate into prevented breaches depends on operator follow-through and vendor patch delivery.

What happens next

The unfixed 23 define the forward timeline. Vendors of the affected components will need to prioritize, patch and disclose — and operators will need to track closure rates against their own risk thresholds. Expect AI-assisted auditing to become a standard part of telecom security procurement, with this 84-flaw result cited as a reference point for what automated review can surface in 5G network software.