🔍 Read the full analysis: CVE Data In Focus: AI’s Impact And The Patch Gap on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A review of U.S. National Vulnerability Database and CVE.org records found 13,934 CVEs published from Oct. 1–25, 2026, compared with 4,389 during all of October 2025. The records do not show how much AI contributed to discovery, while Anthropic says 516 of 6,157 vulnerabilities it reported to maintainers have been patched to its knowledge.
A review of vulnerability records found 13,934 new CVEs published from Oct. 1 through Oct. 25, 2026—more than three times the 4,389 records published during all of October 2025—while available data does not establish how much artificial intelligence drove the increase. The figures, drawn from the U.S. National Vulnerability Database and CVE.org, also sharpen attention on the time between finding a flaw and getting a fix to users.
The review, published Oct. 26 by ThorstenMeyerAI.com, says 88,772 CVE records had been published in 2026 through Oct. 25, 78% more than in all of 2025. Its count includes records by publication date, and the author says the NVD and CVE.org totals agree for October when rejected records are separated from new CVEs.
The rise was uneven across months and organizations. The review counted 8,001 records in June, 9,919 in July, 12,719 in August and 15,074 in September. It reports that Microsoft’s October total rose to 1,455 from 180 a year earlier, while Oracle’s rose to 1,078 from 78. Those counts reflect published CVEs, not a direct measure of the severity of vulnerabilities or the number of systems at risk.
Attribution data is incomplete. Of October’s 13,934 records, 6,346 named a finder, according to the review; 200 explicitly credited an AI lab or AI security firm. The author describes that 1.4% as a floor because many records do not identify who found the flaw. The records therefore cannot establish AI’s overall share of vulnerability discovery.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Growing Gap Between Reports and Fixes
The practical risk is not just how many vulnerabilities are disclosed, but whether affected software receives and applies a correction. Anthropic’s disclosure dashboard, as described in the report, listed 6,157 vulnerabilities reported to maintainers and said 516 were patched to the company’s knowledge. That is roughly one in twelve, but it is Anthropic’s account of its reported findings, not a complete measure of patching across the software industry.
A larger flow of disclosures can put more work on maintainers, vendors and organizations responsible for updating software. At the same time, CVE totals alone do not show how many flaws are exploitable, how widely affected software is deployed, or whether attackers are using a particular vulnerability. Readers should not treat a rising publication count as equivalent to a matching rise in active attacks.
The report also points to attackers’ use of inexpensive AI agents against older vulnerabilities, citing NorForge and Reuters. That concern makes patch speed relevant even when a flaw was disclosed long ago. The supplied material does not provide enough detail to quantify the scale of this activity or connect it to the overall CVE increase.
Products Worth Considering
Withings Sleep Under-Mattress Sleep Tracking Pad
Bowflex SelectTech 840 Adjustable Kettlebell
Coway Airmega 250 Air Purifier for Large Rooms
As an affiliate, we earn on qualifying purchases.
How the October CVE Count Was Built
The review queried the NVD CVE API 2.0 for records published from January 2022 onward, then cross-checked October entries against CVE.org. The data was retrieved at 07:16 UTC on Oct. 26, 2026. The article says October included 13,766 records with 2026 IDs and 202 records later rejected, for 13,934 new records in its Oct. 1–25 total.
A CVE is a public identifier for a disclosed vulnerability; publication commonly follows coordinated reporting by a vendor or other CVE Numbering Authority. The presence of a CVE does not by itself show who first discovered the flaw. The review says 98% of October records carried a 2026 ID and gives a median of 15 days between reserving an ID and publication, which it uses to argue that the increase is not simply an old backlog being released.
AI security programs provide additional but differently scoped figures. Anthropic reported 29,439 candidate vulnerabilities identified by Claude models as of Oct. 2; external firms reviewed 6,123 and confirmed 92.7% as real, according to the company’s dashboard as summarized by the article. Anthropic said those findings had led to 219 CVE records and 365 GitHub advisories. OpenAI’s Patch the Planet program with Trail of Bits reported “hundreds of security issues” across 19 open-source projects, each reviewed by people.
“The curve is still climbing fast, but the acceleration has slowed, not run away.”
— Thorsten Meyer, ThorstenMeyerAI.com
What the CVE Records Cannot Show
The data does not identify the discoverer in more than half of October’s records, and explicit AI-related credits appear in only a small share. That means the review cannot determine AI’s total contribution, whether AI-assisted discovery is responsible for the broader increase, or how many uncredited findings involved AI tools.
The supplied material also does not give a full, comparable account of patched vulnerabilities across vendors, nor does it establish how many of the newly published CVEs are being exploited. The article says CISA’s Known Exploited Vulnerabilities catalog grew less quickly than CVE publications and notes 245 additions in 2025, but the source excerpt ends before giving the corresponding 2026 totals. A direct comparison cannot be completed from the material provided.
Anthropic’s patched count is based on what the company knew at the time of its dashboard reporting. Maintainers may have issued fixes that were not reflected in that figure, and the report does not specify the severity or exposure of each unpatched item. Its estimate that October could end near 17,000 CVEs is a projection based on the pace through Oct. 25, not a final monthly count.
Final October Counts and Patch Status
The October total will become clearer after the month ends and additional records are published or revised. The reported count may also change as CVE records are corrected or rejected. Any assessment of the trend should keep publication dates, rejected entries and the comparison period consistent.
Further updates from maintainers and security programs could clarify how many reported vulnerabilities have received fixes and how quickly those fixes reach users. CISA’s exploited-vulnerability catalog can offer a separate view of confirmed exploitation, but it should not be treated as interchangeable with total CVE publications. For now, the evidence supports a sharp increase in disclosed records and a substantial reported patch queue—not a definitive measure of AI’s role or the resulting level of attacker activity.
Key Questions
How many CVEs were published in October 2026?
The review counted 13,934 new records from Oct. 1 through Oct. 25. Its estimate of about 17,000 for the full month is a projection, not a final count.
Does the increase prove AI is finding most vulnerabilities?
No. Only 200 October records explicitly credited an AI lab or AI security firm, while 54% named no finder. The available records do not establish AI’s full contribution.
How many Anthropic-reported vulnerabilities had been patched?
Anthropic said 516 of 6,157 vulnerabilities it had reported to maintainers were patched to its knowledge. That figure reflects the company’s reporting and knowledge, not an industry-wide patch count.
Do more CVEs mean more active attacks?
Not by themselves. A CVE publication records a disclosed vulnerability; it does not show that the flaw is being exploited. The supplied figures do not establish how many October CVEs attackers used.
Source: ThorstenMeyerAI.com
