🔍 Read the full analysis: CVE Growth In An AI World: The Data On Discovery And Patching on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A report dated Oct. 26 counted 13,934 newly published CVE records from Oct. 1–25, more than three times the total for all of October 2025. The data does not establish how much AI caused the increase, and Anthropic says only 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge.
A review of public vulnerability databases counted 13,934 new CVE records published from Oct. 1–25, 2026—more than three times the 4,389 records issued during all of October 2025. The report, published Oct. 26 by Thorsten Meyer, says the increase is real but the records do not show how much artificial intelligence contributed; a separate figure from Anthropic points to a substantial gap between reported bugs and fixes.
The analysis queried the U.S. National Vulnerability Database (NVD) for records by publication date and checked October entries against CVE.org. It counted 13,766 October records as published and another 202 as later rejected, producing the 13,934 total for Oct. 1–25 used in its comparison. The figures reflect the retrieval time—Oct. 26 at 07:16 UTC—and are not a final full-month count. The report says 98% of October records carried a 2026 identifier, and the median interval from reservation of an identifier to publication was 15 days.
The report found the increase was concentrated among several large organizations. Microsoft accounted for 1,455 records in October to date, compared with 180 in October 2025; Oracle went from 78 to 1,078, and GitHub from 276 to 1,159. The Linux kernel count rose from 660 to 925. The analysis attributes much of the overall curve to a handful of vendors and vulnerability-recording organizations, rather than an evenly distributed rise across software.
Attribution data offers only a partial view of who discovered the flaws. Of the 13,934 records, 6,346 named a finder; 200 explicitly credited an AI lab, AI model or AI security firm, according to the report. That 1.4% is a count of explicit credits, not a reliable estimate of AI’s overall role: the source says 54% of records did not name a finder. Anthropic separately reported that its Claude models had identified 29,439 candidate vulnerabilities as of Oct. 2. External firms reviewed 6,123 and confirmed 92.7% as real; Anthropic said 6,157 had been reported to maintainers, with 516 patched to its knowledge.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Fix Queue Behind the CVE Surge
A higher CVE count shows more vulnerabilities being publicly documented; it does not by itself show that more systems are being actively attacked or that AI caused the increase. For security teams, the practical pressure is the work required to determine whether a published flaw affects their software, prioritize it and deploy a fix. The reported Anthropic figures illustrate the gap: 516 of 6,157 reported vulnerabilities were patched to the company’s knowledge. That leaves many disclosures without a known patch, although the source does not establish why each remains open or whether maintainers have fixed additional cases outside Anthropic’s records.
The distinction matters because discovery and remediation move on different timelines. A growing publication count can add work for maintainers and organizations responsible for updating software, while attackers may continue to use older, already known weaknesses. The supplied source, citing NorForge and Reuters, says attackers are using inexpensive AI agents on old bugs; it gives no underlying incident counts or detailed methodology here. That claim should not be read as evidence that the newly published CVEs are being exploited at a comparable rate.
Public data also has limits as a measure of AI’s contribution. CVE records are disclosure records, not a census of discovery methods. A researcher or tool may have helped find a bug without being named, and an AI-assisted finding may be credited to a person or organization. The explicit attribution total is therefore a documented minimum in this dataset, not a measurement of all AI-assisted security work.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Logitech MX Keys S Wireless Keyboard, Graphite
Jackery Explorer 300 Portable Power Station, 292Wh
As an affiliate, we earn on qualifying purchases.
What the October Records Show
A CVE identifier is assigned through a coordinated vulnerability-disclosure system, commonly involving a vendor or other CVE Numbering Authority. The report argues that this makes the published stream largely a record of the defender and disclosure process: attackers who discover a flaw do not generally file a public CVE, though a vulnerability found in the course of exploitation may later receive one. A CVE count therefore tracks published disclosures, not every bug found or every attack.
The analysis compared monthly records and found 8,001 in June, 9,919 in July, 12,719 in August and 15,074 in September 2026. Its per-day rates rose by 20% from June to July, 28% to August and 22% to September. For October 1–25, the rate was 557 per day, and the author calculated that the increase in the rate over September was about 11%. The report says that is still rapid growth, but not an accelerating curve at the same pace each month. Its estimate that October could finish near 17,000 is a projection, not a completed count.
The source also describes Anthropic’s reported findings as a small share of the CVE records so far: its 6,157 maintainer reports corresponded to 219 CVE records and 365 GitHub advisories at the time described. OpenAI’s Patch the Planet work with Trail of Bits was reported to have found hundreds of security issues across 19 open-source projects, with findings reviewed by people. These program figures use different units and methods from the monthly CVE totals, so they cannot be added together as a single measure of AI-driven discovery.
“The real question is how fast fixes ship.”
— Thorsten Meyer, the report’s author
Limits of the Published Data
The October count is a dated snapshot, not a final figure for the month, and the supplied analysis does not include a complete account of later changes to records. Its totals also depend on the distinction between published and rejected records: it reports 13,766 published records plus 202 later rejected records for the period. Readers should not treat the combined figure as 13,934 valid vulnerabilities without that qualification.
It remains unclear how much of the surge is attributable to AI, newly expanded human review, changes in reporting practices, or other factors. More than half of October records named no finder, and the cited AI credits identify only explicit attributions. The source excerpt also begins discussing CISA’s Known Exploited Vulnerabilities catalog but ends before giving its full comparison for 2026. It therefore does not provide enough information here to quantify whether confirmed exploitation rose alongside CVE publications. The claims about attackers using AI agents and a Chinese open-weight model producing end-to-end exploits are attributed in the source to other reporting or to Anthropic; supporting detail is not included in the supplied material.
October Totals and Patch Progress
The next near-term check is the completed October publication count, which will show whether the month ended near the report author’s roughly 17,000-record projection. That estimate should remain separate from observed data until the month closes and records are checked. Later revisions, rejections and publication delays may also affect comparisons.
For the longer-running question, useful evidence would include updated maintainer and vendor reports on how many disclosed vulnerabilities have been fixed, plus transparent data on confirmed exploitation. The supplied material does not announce a specific deadline for such an update. Until more comparable figures are available, the clearest conclusion is limited: public CVE publication rose sharply, AI’s total contribution cannot be determined from finder credits, and the available Anthropic count shows that many reported vulnerabilities did not yet have a known patch.
Key Questions
How many CVE records were counted for October 2026?
The report counted 13,934 records from Oct. 1–25, based on data retrieved Oct. 26. It says 13,766 were published and 202 were later rejected, so the combined figure should not be mistaken for a count of confirmed, valid vulnerabilities alone.
Does the increase prove AI is finding more vulnerabilities?
No. The source says only 200 records, or 1.4% of the October total, explicitly credited an AI lab, model or security firm. Since 54% named no finder, those credits cannot establish AI’s full contribution.
How many vulnerabilities reported by Anthropic were patched?
Anthropic said 516 of 6,157 vulnerabilities it had reported to maintainers were patched to its knowledge. The figure is based on the company’s knowledge and does not establish the status of every report independently.
Does a higher CVE count mean more attacks are happening?
Not on its own. CVE totals measure published vulnerability records, not confirmed exploitation. The supplied source excerpt does not provide a complete, comparable exploitation dataset for October 2026.
Source: ThorstenMeyerAI.com
