🔍 Read the full analysis: AI, Bug Hunters, And The Growing Gap Between CVEs And Patches on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A source analysis reports 13,934 new CVE records published from Oct. 1–25, 2026, about 3.2 times the total for all of October 2025. The same analysis says just 516 of 6,157 vulnerabilities Anthropic reported to maintainers were patched to its knowledge, underscoring the gap between finding flaws and fixing them. CVE records do not establish how much AI contributed to discovery, and the source does not provide complete patch or exploitation data.
A review of U.S. National Vulnerability Database and CVE.org records found 13,934 new CVE records published from October 1 through October 25, 2026, about 3.2 times October 2025’s full-month total. The figures show a sharp increase in disclosed vulnerabilities, but the review says records do not reveal how many were found with AI; patching remains a separate concern.
The analysis, published by Thorsten Meyer on October 26, counted records by publication date using the NVD’s CVE API and cross-checked October entries against CVE.org. It reports 13,766 records that remained valid in the October tally, plus 202 later rejected records. The source’s headline October total of 13,934 includes both categories. It reports 88,772 CVE records published so far in 2026, 78% more than during all of 2025.
The rise is not evenly distributed across organizations. The analysis counted 1,455 Microsoft records in October, compared with 180 in October 2025; Oracle rose from 78 to 1,078, while GitHub rose from 276 to 1,159. It attributes much of the increase to a small number of vendors and vulnerability record coordinators. The source notes that Microsoft’s October Patch Tuesday addressed 1,413 CVEs, citing SecurityWeek.
The records also give only a partial picture of who found the flaws. Of October’s 13,934 entries, 6,346 named a finder, according to Meyer’s review. Some 200 records—1.4% of the total—explicitly credited an AI lab or AI security company. That number is not a measure of AI’s full contribution: most records do not identify a finder, and a CVE entry does not necessarily describe the tools used to discover a flaw.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Work Begins After Discovery
A higher disclosure count can help software maintainers and users learn about flaws, but a published CVE is not the same as a repaired system. The source reports that Anthropic had disclosed 6,157 vulnerabilities to maintainers and that, as of its dashboard data dated October 2, 516 were patched to the company’s knowledge. That is roughly one in twelve, though it reflects Anthropic’s tracking and should not be treated as a complete measure of the status of every reported vulnerability.
The gap matters because organizations must still determine whether a flaw affects their software, obtain and test a fix, and deploy it across systems. Until that work is done, a disclosed vulnerability may remain relevant to defenders and potential attackers alike. The source also cites reporting by NorForge and Reuters on attackers using low-cost AI agents against older vulnerabilities. That reporting points to a security concern, but the material provided does not quantify the agents’ impact or establish a direct link to October’s CVE increase.
For readers responsible for technology systems, the figures are a reason to distinguish discovery from remediation. The CVE count measures published records over a stated period; it does not show how many systems are exposed, how quickly organizations install fixes, or whether an individual flaw is being exploited.
Products Worth Considering
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
As an affiliate, we earn on qualifying purchases.
What the CVE Counts Show
A CVE is a public identifier for a disclosed cybersecurity vulnerability. A CVE Numbering Authority, often a vendor, assigns or publishes records as part of coordinated disclosure. The source argues that a CVE tally is therefore largely a record of the disclosure process—not a count of vulnerabilities being found by criminals. If attackers discover a flaw, they do not file a CVE; a record may be created later as defenders respond.
Meyer’s data indicates that the daily publication rate climbed from 267 records in June to 320 in July, 410 in August and 502 in September 2026. For October 1–25, the reported daily rate was 557. The analysis describes October’s growth rate as slower than the preceding monthly increases, so its figures support a steep rise but not the claim that growth was accelerating without limit. Its estimate that October could end near 17,000 records is a projection, not a final count.
AI-related disclosures are one part of the picture. Anthropic’s dashboard, as summarized in the source, listed 29,439 candidate vulnerabilities identified by Claude models, with external firms reviewing 6,123 and confirming 92.7% as real. The company said 6,157 had been reported to maintainers. OpenAI’s Patch the Planet program with Trail of Bits reported hundreds of security issues across 19 open-source projects, with findings reviewed by people. These company-reported figures describe their programs and do not establish how much of the overall CVE surge is attributable to AI.
“Going parabolic.”
— David Shapiro podcast host, as quoted in Meyer’s article
The available CVE records do not establish how many vulnerabilities were discovered with AI assistance. Meyer found that 54% of October entries named no finder and that 1.4% explicitly credited an AI lab or security firm. The latter is a documented minimum, not a reliable estimate of all AI involvement. The source also says some prominent finders were researchers at Vietnamese institutions and companies, so its records do not support a simple geographic account of who found the vulnerabilities.
Patch status is also incomplete. Anthropic’s figure is based on what the company knew as of its reporting, and the material does not provide a comparable, independently checked patch rate across vendors or all October CVEs. The supplied source cuts off before giving the full CISA Known Exploited Vulnerabilities comparison, so it does not support a complete account of how exploitation trends compare with the CVE increase. Whether the rise reflects more AI-assisted discovery, changes in vendor disclosure practices, or other factors remains unclear.
Track Fixes Alongside Disclosures
The October publication total remains a partial-month count as of October 26. A final monthly comparison will require the remaining records and any later corrections or rejections. The analysis’s estimate of about 17,000 records for the month should be read as a projection only, not a confirmed outcome.
Further evidence will be needed to measure whether AI is changing vulnerability discovery at scale: more complete information on discovery methods, consistent reporting across vendors and clearer links between disclosures and fixes. For the near term, the most useful follow-up is whether maintainers publish patches and whether organizations deploy them. CVE totals show that disclosures are rising; they do not, by themselves, show that vulnerable systems are being repaired or exploited.
Key Questions
How many CVE records were published in October 2026?
The source analysis counted 13,934 records from October 1–25, including 13,766 records it reports as valid and 202 later rejected. It is a partial-month total, not a final October figure.
Does the increase prove AI is finding most vulnerabilities?
No. The review says only 1.4% of October records explicitly credited an AI lab or security company, while 54% named no finder. Those records cannot establish AI’s full contribution.
How many Anthropic-reported vulnerabilities were patched?
Anthropic’s dashboard, as summarized in the source and dated October 2, listed 516 patched to the company’s knowledge out of 6,157 vulnerabilities reported to maintainers. The figure is not presented as a complete independent audit.
Does a CVE publication mean a system is already exposed to attack?
No. A CVE identifies a disclosed vulnerability; it does not show whether a particular system uses affected software, whether a patch is available or installed, or whether the flaw is being exploited.
Source: ThorstenMeyerAI.com
