🔍 Read the full analysis: How To Read The CVE Rise Alongside AI And Patch Gaps on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
The source’s analysis of CVE records found 13,934 published from Oct. 1–25, 2026, compared with 4,389 for all of October 2025. The rise does not show how many vulnerabilities AI found, and Anthropic says only 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge.
An analysis published Oct. 26 found 13,934 new CVE records published from Oct. 1 through Oct. 25, more than three times the 4,389 records for all of October 2025. The figures document a rapid rise in disclosed vulnerabilities, but they do not establish how much of the increase came from AI; the analysis points instead to the challenge of getting reported flaws fixed.
The author says the figures were gathered from the National Vulnerability Database (NVD) and cross-checked against CVE.org. The NVD query covered records by publication date and status. The analysis reports 13,766 records published in October, plus 202 records later rejected; its 13,934 figure includes those rejected records. It also reports 88,772 records so far in 2026, 78% more than the full-year 2025 total.
The increase is concentrated among a small number of organizations. Microsoft had 1,455 records in October, compared with 180 in October 2025; Oracle had 1,078, compared with 78. GitHub rose from 276 to 1,159, and VulnCheck from 163 to 2,085. The Linux kernel count grew from 660 to 925. These comparisons cover October 2025 versus Oct. 1–25, 2026, according to the analysis.
The pace remains high, but the source’s month-to-month comparison does not support describing the growth as accelerating without qualification. It calculates daily-rate increases of 20% from June to July, 28% from July to August and 22% from August to September, followed by about 11% in October to date. Its estimate of roughly 17,000 records for the full month is a projection, not a final count.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Fix Queue Is the Key Measure
A larger CVE count means more vulnerabilities are being publicly recorded; it does not, by itself, show that attacks have risen at the same rate or that AI caused the increase. For organizations responsible for software, the practical concern is whether maintainers can assess reports, prepare fixes and get those fixes to users. A disclosed flaw that remains unpatched can leave a period of exposure, though the analysis does not quantify the risk for individual products.
The analysis cites Anthropic’s disclosure dashboard, which said that 6,157 vulnerabilities had been reported to maintainers. As of the dashboard’s Oct. 2 update, Anthropic said 516 were patched to its knowledge—about one in twelve. That figure is limited to the vulnerabilities Anthropic reported and the company’s knowledge of their patch status; it is not a measure of the overall software ecosystem.
The article also says attackers are using low-cost AI agents against older bugs, citing NorForge and Reuters. That claim underscores why security teams need to track exploitation and remediation as well as disclosures. However, the supplied source material gives no detailed figures or direct quotation from those reports, so the scale of that activity cannot be established here.
Products Worth Considering
DJI Osmo Mobile 8 Standard Combo Phone Gimbal Stabilizer
Amazon Kindle Scribe Colorsoft 64GB (1st Generation)
Apple iPad Air 11-inch (M2), 512GB, Wi-Fi, Space Gray
As an affiliate, we earn on qualifying purchases.
What CVE Counts Can Show
A CVE is a public identifier for a disclosed vulnerability. Records are generally published through the CVE program by authorized numbering authorities, often vendors, as part of coordinated disclosure. The analysis distinguishes who publishes a record from who initially discovered the bug: the record may credit a finder, but it may omit that information.
For October, the author says 6,346 of 13,934 records named a finder. The remaining 54% did not. The analysis counted 200 records, or 1.4%, that explicitly credited an AI lab or AI security firm as a finder, reporter or tool: 123 mentioning Anthropic or Claude, 65 naming AI security companies and 16 naming OpenAI. The author describes this as a floor, not a complete count of AI involvement.
Separate company programs offer another view but use different measures. Anthropic reported 29,439 candidate vulnerabilities found by Claude models; external firms reviewed 6,123 and confirmed 92.7% as real, according to the company dashboard cited in the analysis. The source says those findings were associated with 219 CVE records and 365 GitHub advisories at the time. OpenAI’s Patch the Planet program with Trail of Bits reported “hundreds of security issues” across 19 open-source projects, each reviewed by people. These company-reported results do not translate directly into monthly CVE totals.
“29,439 candidate vulnerabilities”
— Anthropic, as reported in its disclosure dashboard
AI Attribution Remains Incomplete
The available CVE records cannot establish what share of the overall increase was caused by AI-assisted discovery. More than half of October records named no finder, while the 1.4% explicitly credited to AI labs or security firms is only a count of records with clear attribution. Uncredited AI use, mixed research methods and differences in reporting practices are not measured in the source’s tally.
The data also does not establish how many newly disclosed flaws are exploitable, how many are being actively targeted, or how long fixes take across all affected products. The source says CISA’s Known Exploited Vulnerabilities catalog grew far less than the CVE count and notes 245 additions during 2025, but the supplied material cuts off before giving a comparable 2026 total. A year-to-year comparison of known exploited entries therefore cannot be made from the information provided.
Anthropic’s patched figure is also qualified: it reflects the company’s knowledge as of its dashboard update, not a complete independent audit. The source does not provide a common measurement method for comparing the vendor and AI-lab counts.
Track October’s Final Count
The Oct. 1–25 total is not the final October figure. The analysis estimates about 17,000 records if the observed pace holds, but the final count could differ. It also reports that the NVD and CVE.org figures agree on the October records it checked, while noting that 202 records were later rejected.
For a clearer picture of the security impact, subsequent reporting would need to compare finalized CVE totals with confirmed exploitation, attribution quality and patch status over the same time periods. Readers should also watch for updated maintainer responses to disclosed vulnerabilities and further details from the cited company programs. Until those measures are available, the record surge is evidence of more published disclosures—not a standalone measure of AI’s contribution or of attack activity.
Key Questions
How many CVE records were published in October 2026?
The analysis counted 13,934 records from Oct. 1–25. It says 13,766 were published in October and another 202 were later rejected. The full-month total was not yet known.
Does the increase prove AI found most of the vulnerabilities?
No. The records do not identify a finder for 54% of the October entries. The analysis explicitly credits an AI lab or security firm on 1.4%, a figure it describes as a floor rather than a complete measure of AI involvement.
How many vulnerabilities reported by Anthropic were patched?
Anthropic’s dashboard said that 516 of 6,157 vulnerabilities it had reported to maintainers were patched to its knowledge as of its Oct. 2 update. This is a company-reported figure, not an ecosystem-wide patch rate.
Does a higher CVE count mean more attacks are happening?
Not on its own. CVE totals track published vulnerability records. They do not directly measure active exploitation, and the supplied source does not provide a complete comparable 2026 total for CISA’s Known Exploited Vulnerabilities catalog.
Source: ThorstenMeyerAI.com
