🔍 Read the full analysis: Understanding The CVE Rise Through AI, Bug Hunters, And Patching on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The source report counted 13,934 CVE records published from Oct. 1–25, 2026, 3.2 times the total for October 2025. The data shows a sharp rise in disclosures but cannot establish how much AI contributed; the report says only 516 of 6,157 vulnerabilities Anthropic reported to maintainers were patched to its knowledge.
A report published Oct. 26 counted 13,934 CVE records published in the first 25 days of October 2026—3.2 times the number recorded across all of October 2025—while finding that the available data cannot show how much artificial intelligence contributed to the rise. The report identifies patching, not discovery alone, as a key unresolved measure of risk.
The report’s author queried the U.S. National Vulnerability Database’s CVE API for records by publication date and cross-checked October records against CVE.org. The sources agreed on 13,766 records published in October, plus 202 records later rejected. The report’s 13,934 figure for Oct. 1–25 is its count of new records in that period. It said 88,772 records had been published so far in 2026, 78% more than in all of 2025.
The growth was steep, but the report cautioned against describing it as “parabolic.” Its daily-rate calculations show increases of 20% from June to July, 28% from July to August, and 22% from August to September; the October rate had risen about 11% from September. The author projected that October could end near 17,000 records if the pace continued, but identified that figure as a projection, not a count.
The increase was concentrated among a small number of organizations. The report counted 1,455 Microsoft records in October, compared with 180 in October 2025, and 1,078 for Oracle, compared with 78. It attributed much of Microsoft’s total to the company’s October Patch Tuesday, which SecurityWeek reported addressed 1,413 CVEs. These figures describe published records, not a count of newly discovered, exploitable flaws or successful attacks.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
Why the Patch Gap Matters
More published CVEs give software makers and users information about known weaknesses, but a disclosure does not mean a vulnerability has been fixed across affected products. The report cites Anthropic’s dashboard, which listed 6,157 vulnerabilities reported to maintainers; Anthropic said it knew of 516 patches. That is about one in twelve, based on the figures in the report. The status of the remaining reports is not established by that ratio alone: maintainers may be investigating, preparing fixes, or handling issues in other ways.
The report also distinguishes vulnerability disclosures from confirmed exploitation. It says CISA’s Known Exploited Vulnerabilities catalog, which tracks vulnerabilities known to be exploited in the wild, grew less sharply than the CVE count. The supplied source material gives a figure of 245 additions in 2025 but does not provide the comparable current-year total, so it does not support a precise comparison for 2026. The distinction matters: a rising number of records signals more disclosed issues, not necessarily a matching increase in attacks.
For organizations, the practical implication is to track exposure and remediation, rather than treating the volume of CVEs as a direct measure of immediate danger. Affected software, available fixes, exploitation evidence and the time required to deploy patches all shape the risk. The report says attackers are using low-cost AI agents against older flaws, citing NorForge and Reuters, but the supplied material does not give enough detail to quantify the activity or connect it to the October disclosure surge.
Products Worth Considering
Anker SOLIX C200 DC Portable Power Station, 192Wh, 200W
Sony WH-1000XM4C Wireless Noise-Cancelling Headphones, Black
Amazon Kindle Scribe Colorsoft 64GB (1st Generation)
As an affiliate, we earn on qualifying purchases.
How October’s CVE Count Was Built
A CVE is a public identifier used to refer to a disclosed cybersecurity vulnerability. According to the report, records are generally published through CVE Numbering Authorities, often after a vendor or maintainer has coordinated disclosure. A CVE record is not, by itself, evidence that a flaw is being exploited or that a fix is available. The report says 98% of October records carried a 2026 ID and gives a median of 15 days between reserving an ID and publication, which it uses to argue that the surge was not primarily a release of old records.
The record count also does not reveal who originally found each flaw. Of the 13,934 October records examined, 6,346 named a finder, the report said. It found 200 records—1.4%—that explicitly credited an AI lab or AI security firm. The author described that share as a floor rather than a complete estimate because records often omit the finder. The report also cited Anthropic’s disclosure dashboard, which listed 29,439 candidate vulnerabilities found by Claude models as of Oct. 2; external firms had reviewed 6,123 and confirmed 92.7% as real, according to the dashboard figures quoted in the report.
The report said Anthropic’s findings had led to 219 CVE records and 365 GitHub advisories at the time of its review. It also cited OpenAI’s Patch the Planet program with Trail of Bits, which reported “hundreds of security issues” across 19 open-source projects, each reviewed by hand. These program figures concern different stages of discovery and review, so they cannot be directly equated with the total number of published CVEs.
What CVE Records Cannot Show
The available records do not establish how much AI caused the surge, whether AI tools found flaws that otherwise would have remained undiscovered, or how many vulnerabilities were discovered by people using AI without crediting it. More than half of the October records examined did not name a finder, limiting conclusions about who is doing the research.
The supplied source material also does not include the full CISA comparison for 2026, nor enough detail to independently assess its claim about attackers using AI agents on older vulnerabilities. It cites an Anthropic statement that a Chinese open-weight model can build exploits end to end with weak safeguards, but provides no model name, testing method or detailed findings. That statement remains an attributed claim, not an independently established conclusion in the material provided.
It is also unclear how many of Anthropic’s reported vulnerabilities remain unpatched, are still being assessed, or were resolved without a patch. The 516 figure is what Anthropic said it knew to be patched, not a comprehensive status report for every issue. The source’s counts are a snapshot, and later CVE updates or maintainer disclosures could change them.
Track Fixes and Exploitation
The next useful indicators are updated CVE records, maintainers’ remediation notices and additions to CISA’s Known Exploited Vulnerabilities catalog. Those can help distinguish a larger disclosure pipeline from growth in vulnerabilities that are both exposed and being exploited. The report does not identify a scheduled follow-up date for its counts.
Organizations relying on affected software will need to check vendor advisories and assess whether fixes apply to their systems. The October figures may also change as records are corrected, rejected or added. Until more complete attribution and patch-status data is available, the report’s central finding remains limited but clear: disclosures have risen sharply, while the contribution of AI and the speed of remediation cannot yet be measured from CVE totals alone.
Key Questions
How many CVE records were published in October 2026?
The report counted 13,934 new records from Oct. 1–25. It also said its cross-check found 13,766 records published in October, with another 202 later rejected. The month was not complete when the report was published.
Does the CVE increase prove AI is finding more bugs?
No. The report found that 1.4% of October records explicitly credited an AI lab or AI security firm, but more than half did not name a finder. It says the records cannot measure AI’s full contribution.
Does a CVE record mean a vulnerability is being exploited?
No. A CVE is a disclosure record and identifier. The report distinguishes that count from CISA’s Known Exploited Vulnerabilities catalog, which tracks vulnerabilities known to be exploited.
How many vulnerabilities reported by Anthropic were patched?
Anthropic’s figures, as cited in the report, said it had reported 6,157 vulnerabilities to maintainers and knew of 516 patches. The report does not provide a full status breakdown for the remaining issues.
Source: ThorstenMeyerAI.com
