🔍 Read the full analysis: AI And Bug Hunters Meet The Growing CVE Patch Gap on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A review of NVD and CVE.org records counted 13,934 CVEs published from Oct. 1 through Oct. 25, 2026, 3.2 times the total for October 2025. The rise reflects concentrated reporting by major vendors and vulnerability coordinators, but public records do not establish how much AI contributed. Anthropic says 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge, highlighting the gap between discovery and remediation.
An analysis published October 26 counts 13,934 CVE records published from Oct. 1 through Oct. 25, 2026, while data cited from Anthropic shows only 516 of 6,157 reported vulnerabilities patched to the company’s knowledge. The figures point to two distinct developments: a sharp rise in vulnerability disclosures and a potential slowdown between finding flaws and getting fixes to users.
The analysis by Thorsten Meyer says the October total is 3.2 times the 4,389 records published during all of October 2025. It counts 88,772 CVE records so far in 2026, 78% more than the full-year 2025 total. The October figure covers the first 25 days, not a complete month.
The rise is not evenly distributed among software publishers. The analysis counts 1,455 Microsoft records in October, compared with 180 a year earlier, and 1,078 for Oracle, compared with 78. It attributes much of the increase to major vendors and vulnerability coordinators, rather than to a uniform surge across all software. The source also says that October’s daily publication rate had risen about 11% so far, slower than the month-to-month growth it calculates for June through September.
The analysis says it queried the U.S. National Vulnerability Database API and cross-checked October records against CVE.org. It reports that 6,346 of the 13,934 October records named a finder. Just 200 explicitly credited an AI lab, AI model or AI security firm, a count the analysis describes as a floor because many records lack finder details. CVE counts alone cannot establish how much AI contributed to discovering the flaws.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
Why Patch Delays Matter
The practical security impact depends not only on how many flaws are found, but also on whether maintainers can review, fix and distribute patches before vulnerable systems are attacked. A high disclosure count can help defenders identify weaknesses, but it also adds work for software teams and users who must determine which products are affected and apply updates.
Anthropic’s reported figures illustrate the scale of that work: of 6,157 vulnerabilities reported to maintainers, the company says 516 were patched to its knowledge. That does not establish that the remaining issues are all exploitable, unaddressed or equally severe. It does show why discovery totals should not be mistaken for fixes delivered. The analysis also says public CVE records provide limited information about who discovered each issue, making it difficult to measure AI’s role from the database alone.
The source cites reporting by NorForge and Reuters that attackers are using inexpensive AI agents against older bugs. That claim points to a separate risk from the publication surge: automation could make it easier to search for weaknesses or attempt exploitation. The material supplied does not provide figures that quantify the scale of this activity or show that it caused the October rise.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
DJI Osmo Mobile 7P with Mic Mini TX (Infinity Black) Gimbal Stabilizer
Bose TV Speaker (2nd Gen) Compact Soundbar with Bluetooth and HDMI Connectivity
As an affiliate, we earn on qualifying purchases.
How October’s Counts Were Built
A CVE is a public identifier and disclosure record for a vulnerability; publication does not by itself mean that a flaw is actively exploited or that a patch is available. According to Meyer’s methodology, records were counted by publication date, across statuses, using the NVD CVE API 2.0 and a cross-check against CVE.org. The data was retrieved on October 26, 2026. The analysis says 202 October records were later rejected, a distinction relevant to how its headline count is interpreted.
The source reports that 98% of October records carried a 2026 identifier and that the median interval from reserving an ID to publication was 15 days. Those details are offered as evidence against the idea that October’s total was simply a release of a large, old backlog. The figures remain the analysis’s own count and interpretation of the underlying records.
AI discovery programs provide another measure, but their numbers are not directly comparable with CVE totals. Anthropic’s dashboard, as of October 2, listed 29,439 candidate vulnerabilities found by Claude models. The company said external firms reviewed 6,123 and confirmed 92.7% as real; it had reported 6,157 to maintainers. The analysis says those findings had resulted in 219 CVE records and 365 GitHub advisories at the time it reviewed them. OpenAI’s Patch the Planet program with Trail of Bits reported “hundreds of security issues” across 19 open-source projects, with each issue reviewed by people.
What the Records Cannot Show
The supplied analysis does not establish how many October discoveries were made with AI. Only 46% of records name a finder, and the 200 AI-related credits are an explicit-credit count, not a measure of all AI involvement. A human researcher, vendor or coordinator may have used tools without that appearing in a CVE record.
The patch figure is also limited: Anthropic says 516 reported issues were patched to its knowledge. The source does not say how many of the others are being investigated, disputed, fixed without confirmation, or considered non-urgent. Nor does it provide enough detail to compare issue severity or affected systems across the full set.
The supplied source cuts off while discussing additions to CISA’s Known Exploited Vulnerabilities catalog, after stating that it added 245 entries in 2025. It provides no complete comparison for 2026. The material therefore does not support a firm conclusion about whether confirmed exploitation has risen alongside CVE publications.
Tracking Fixes and Exploitation
The next useful indicators are whether maintainers confirm fixes for the reported vulnerabilities and whether affected software vendors issue updates. Readers should distinguish a published CVE from a confirmed exploit and from a patch available for deployment; these are separate stages, and the source does not provide a complete timeline for them.
Further reporting would also need consistent data on finder attribution and AI tool use, as well as a full comparison of CISA’s exploited-vulnerability catalog over time. For now, the October count is a snapshot through October 25, 2026, and any estimate of the month-end total is a projection rather than an observed count. The central question raised by the analysis is whether software maintainers can turn a growing number of discoveries into verified, timely fixes.
Key Questions
How many CVE records were published in October 2026?
The analysis counted 13,934 records from October 1 through October 25. That is a partial-month count, not the final October total.
Does the increase prove that AI found most of the vulnerabilities?
No. The source says 200 records, or 1.4%, explicitly credited an AI lab, model or AI security firm, while 54% named no finder. Those records cannot establish how often AI tools were used without being credited.
What does Anthropic say about patching?
Anthropic’s dashboard, as described in the analysis, lists 6,157 vulnerabilities reported to maintainers and says 516 were patched to its knowledge. The source does not provide the status or severity of every remaining issue.
Does a CVE record mean a vulnerability is being exploited?
No. A CVE is a public vulnerability record; publication alone does not show that attackers are exploiting the issue or that a fix is available. The supplied material does not provide a complete 2026 comparison of confirmed exploitation.
What should readers watch for next?
Look for maintainer or vendor patch notices, confirmation that fixes are available, and updated data on known exploitation. Those measures help show whether the increase in discovery is translating into protection for affected users.
Source: ThorstenMeyerAI.com
