🔍 Read the full analysis: CVE Growth, Bug Hunters, And Patch Gaps: The AI Connection on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A review of NVD and CVE.org data found 13,934 CVE records published from Oct. 1 through Oct. 25, 2026, with growth concentrated among a small number of vendors and numbering authorities. The data does not establish how much AI drove the rise; a separate Anthropic dashboard says 516 of 6,157 reported vulnerabilities were patched to the company’s knowledge.
A review of public vulnerability records found 13,934 CVEs published from Oct. 1 to Oct. 25, 2026, while figures reported by Anthropic point to a gap between discovered vulnerabilities and fixes known to have shipped. The data documents a sharp increase in disclosures, but does not establish how much artificial intelligence caused it or how many reported flaws remain exploitable.
The analysis, published by Thorsten Meyer on Oct. 26, counted records by publication date using the U.S. National Vulnerability Database’s CVE API and cross-checked October IDs against CVE.org. It says the sources agreed on 13,766 records published in October, with another 202 later rejected. The analysis separately reports 13,934 records for Oct. 1–25; the supplied material does not explain the difference between those totals. It says 98% of October records had a 2026 ID and the median interval between ID reservation and publication was 15 days.
The report compares the 13,934 records in the first 25 days of October with 4,389 across all of October 2025. For full months in 2026, it lists 8,001 records in June, 9,919 in July, 12,719 in August and 15,074 in September. Its daily-rate comparisons show growth slowing from 20% between June and July, 28% between July and August and 22% between August and September to about 11% in October so far. A projected October total near 17,000 is the author’s estimate, not a final count.
The increase is uneven across organizations. The analysis says Microsoft’s October total rose from 180 records in 2025 to 1,455 in 2026; Oracle’s rose from 78 to 1,078, with almost all the latter published on Oct. 20. GitHub rose from 276 to 1,159 and VulnCheck from 163 to 2,085. Linux kernel records increased from 660 to 925. Those counts show where records were published, but do not by themselves identify who discovered each flaw or whether AI was involved.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
Why Patch Delays Matter
The figures matter because a rise in disclosed vulnerabilities increases the volume that software maintainers, vendors and users must review. But a CVE count measures published vulnerability records, not successful attacks, severity, affected installations or the speed at which users receive fixes. Treating the total as a direct measure of danger would overstate what the data can show.
The report identifies remediation as a concern. Anthropic’s disclosure dashboard, as described in the source, listed 6,157 vulnerabilities reported to maintainers and said 516 had been patched to the company’s knowledge—about one in twelve. That is a company-reported figure, not an independently verified measure of all open-source patch status. Still, it illustrates why discovery alone does not reduce risk: maintainers must confirm reports, prepare fixes, and users must install them.
The analysis also says CISA’s Known Exploited Vulnerabilities catalog grew less sharply than CVE publications, citing 245 additions during 2025. The supplied material does not provide a comparable 2026 total or enough detail to assess exploitation trends. A slower rise in that catalog would not show that newly disclosed bugs are harmless; it is a separate measure of vulnerabilities known to have been exploited.
Products Worth Considering
Jackery Explorer 300 Portable Power Station, 292Wh
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Amazon Kindle Scribe Colorsoft 64GB (1st Generation)
As an affiliate, we earn on qualifying purchases.
What CVE Counts Can Show
A CVE is a public identifier for a disclosed vulnerability. The source describes publication as part of coordinated disclosure, generally handled by a CVE Numbering Authority, often after a vendor has prepared a fix or a disclosure deadline has passed. An attacker who finds a flaw does not ordinarily publish a CVE directly; a later public record can document defenders’ response to a bug that was first exploited. That means the records can reflect disclosure practices as well as underlying discovery.
Attribution is incomplete in the October data. The analysis says just 6,346 of 13,934 records—46%—named a finder. It counted 200 records, or 1.4%, that explicitly credited an AI lab, AI model or AI security firm. The author calls this a floor, since records may omit the finder or fail to identify AI’s role. Those entries cannot establish AI’s overall contribution, nor do they support a claim that the entire increase came from AI.
The source also reports Anthropic’s dashboard figures: Claude models had identified 29,439 candidate vulnerabilities; external firms reviewed 6,123 and confirmed 92.7% as real, according to the company. Anthropic said 6,157 had been reported to maintainers. The source says those findings had produced 219 CVE records and 365 GitHub advisories at the time. OpenAI’s Patch the Planet program with Trail of Bits reported “hundreds of security issues” across 19 open-source projects, with each reviewed by people. These are company and program disclosures, not a complete, independently audited census of AI-assisted security work.
“29,439 candidate vulnerabilities”
— Anthropic, as reported in its disclosure dashboard
Limits in Attribution and Patch Data
The available records do not reveal the share of the overall CVE increase caused or accelerated by AI. The 1.4% explicitly attributed to AI-related organizations is not a reliable estimate of total AI involvement because more than half of records name no finder, and the source says organizations may not record whether a tool assisted discovery.
Patch status is also incomplete. Anthropic’s count reflects what the company knew about vulnerabilities it reported, while the source provides no independent verification, common reporting date for every record, or measure of how many fixes reached users. The material does not give a complete 2026 CISA exploited-vulnerability comparison, nor does it establish that AI agents are driving a broad rise in successful attacks. Claims about attackers using AI and about a Chinese open-weight model producing end-to-end exploits are reported in the source without supporting detail here, so their scale and independent verification remain unclear.
There is also an unresolved difference between the source’s total of 13,934 records for Oct. 1–25 and its statement that October’s sources agreed on 13,766 published records plus 202 later rejected. The article does not reconcile those counts, so readers should treat the period totals with that caveat.
Track Fixes and Final Counts
The October count remains provisional because the month was not complete when the analysis was published. A final tally, alongside a reconciliation of the different October totals, would clarify the scale of the month’s disclosures. Further reporting on the data methods could also show how rejected records and publication dates were handled.
For the security impact, the more useful next indicators are verified patch status, time to remediation and confirmed exploitation, reported with clear dates and comparison periods. Maintainer updates and future CISA catalog additions may help establish whether the disclosure surge is accompanied by a comparable change in known exploitation. The source provides no timetable for those updates, so the extent and pace of that change remain open.
Key Questions
How many CVEs were published in October 2026?
The source analysis reports 13,934 records from Oct. 1 through Oct. 25. It also says NVD and CVE.org agreed on 13,766 records published in October, plus 202 later rejected; the source does not reconcile the totals, and October was not complete.
Does the increase prove AI caused a CVE surge?
No. The records reviewed do not establish AI’s overall role. Only 1.4% explicitly credited an AI lab or AI security firm, while 54% named no finder, according to the analysis.
What did Anthropic report about patches?
Anthropic’s dashboard, as described in the source, said the company had reported 6,157 vulnerabilities to maintainers and knew of 516 that had been patched. The figure is company-reported and does not establish the patch status of all vulnerabilities.
Do more CVE records mean more active attacks?
Not on their own. CVE publication counts track disclosures, not exploitation. The source says CISA’s Known Exploited Vulnerabilities catalog grew less sharply than CVE records, but it does not provide a complete 2026 comparison or show how many October disclosures were exploited.
Source: ThorstenMeyerAI.com
