🔍 Read the full analysis: How CVE Growth And Patch Delays Intersect In The AI Era on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
The source’s analysis of public records counts 13,934 CVE records published from Oct. 1–25, 2026, and 88,772 for the year to date. Anthropic says 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge, highlighting how fixes may lag behind discovery. The data does not establish how much AI drove the CVE increase or how many newly disclosed bugs are being exploited.
An analysis published Oct. 26, 2026, counts 13,934 CVE records published from Oct. 1 through Oct. 25, while Anthropic reports that maintainers have patched 516 of 6,157 vulnerabilities it disclosed to them, to the company’s knowledge. The figures point to a growing workload for software maintainers, but do not show how much artificial intelligence caused the increase or how many of the newly recorded flaws are being exploited.
The analysis by Thorsten Meyer says it queried the National Vulnerability Database (NVD) by publication date and cross-checked October IDs against CVE.org. It reports 13,934 records for the first 25 days of October, compared with 4,389 records in all of October 2025. The source gives a separate NVD count of 13,766 October records, plus 202 later rejected records; it does not fully reconcile that distinction with its 13,934 cross-checked total.
For 2026 to date, the analysis counts 88,772 records, which it says is 78% more than the full-year 2025 total. It argues that the rise is not evenly spread across software publishers: Microsoft’s October total was 1,455 records, compared with 180 in October 2025; Oracle rose from 78 to 1,078. The source attributes much of Microsoft’s October count to a Patch Tuesday release that fixed 1,413 CVEs, citing SecurityWeek.
The records offer limited detail on who first found each flaw. Of the 13,934 October records in the source’s CVE.org review, 6,346 name a finder. The author counted 200 records, or 1.4%, that explicitly credit an AI lab or AI security firm. The article cautions that this is a documented minimum, not a measure of AI’s full contribution, because many records omit finder information.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
Why the Patch Gap Matters
More disclosures give software vendors and users a clearer record of known flaws, but a published CVE is not the same as a repaired system. The practical risk depends on whether affected software is in use, whether a fix is available, and how quickly maintainers and operators apply it. Anthropic’s figures make that distinction visible: it says it reported 6,157 vulnerabilities to open-source maintainers and knows of 516 patches. That leaves many reports without a patch recorded in the company’s account, though the source does not establish why each remains unpatched or whether some fixes have gone unreported.
The timing matters because disclosure can create work for maintainers and organizations already responsible for updating widely used software. A growing volume may make it harder to review, prioritize, test and deploy fixes. However, the CVE count alone cannot show that systems are less secure, nor that every disclosed flaw is equally severe or exploitable. Readers and security teams should distinguish the rate of publication from the number of vulnerable systems and the pace at which those systems are fixed.
The source also cites reporting by NorForge and Reuters about attackers using low-cost AI agents against older vulnerabilities. That is a separate concern from the increase in CVE records: the provided material does not quantify the reported activity or link it to the October records. The broader point is that both defenders and attackers may use AI, while the operational outcome still depends on software exposure and remediation.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
DJI Osmo Mobile 8 Gimbal with Mic Mini Transmitter, Infinity Black
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Black
As an affiliate, we earn on qualifying purchases.
What the October Counts Measure
A CVE record identifies a publicly disclosed vulnerability. The source explains that records are generally published through CVE Numbering Authorities, often vendors, as part of coordinated disclosure. A criminal who finds a flaw does not ordinarily file a CVE; a record may instead appear when defenders disclose the issue or respond to exploitation. That means the published count describes disclosures, not all bugs discovered privately or all attacks underway.
The author says 98% of October records carry a 2026 ID and gives a median of 15 days between reserving an ID and publication, arguing against the idea that the month’s count mainly reflects a backlog release. The source’s daily-rate series also shows growth through September, followed by a slower increase in October. Its estimate that October could finish near 17,000 is explicitly a projection based on the pace at the time, not a final count.
AI-related research is part of the picture but is not directly measurable from the CVE tally. Anthropic’s dashboard, as described in the source, lists 29,439 candidate vulnerabilities identified by Claude models; external firms reviewed 6,123 and confirmed 92.7% as real. The company says 6,157 were reported to maintainers, yet those reports had produced 219 CVE records and 365 GitHub advisories at the time cited. OpenAI’s Patch the Planet program with Trail of Bits reported “hundreds of security issues” across 19 open-source projects, with manual review, according to the source.
“516 are patched, to its knowledge.”
— Thorsten Meyer, citing Anthropic’s disclosure dashboard
What the Public Data Cannot Show
The figures do not establish what share of the 2026 increase was caused by AI tools. The source finds explicit AI-related credit on 1.4% of October records, but more than half of the records do not name a finder. That missing information prevents a reliable estimate of AI’s contribution, and the acknowledged records may not capture tools used behind the scenes.
The source says the CISA Known Exploited Vulnerabilities catalog grew by less than the CVE count, reporting 245 additions in 2025, but the supplied material ends before giving the later comparison figures. It therefore does not support a complete comparison of 2026 exploitation trends with CVE publication growth. Nor does it provide a final October count, a comprehensive measure of patch completion, or evidence that the cited attacker activity resulted from vulnerabilities in this month’s records.
The October totals also require care: the article presents 13,934 records in its headline figures and cross-check, while separately giving an NVD count of 13,766 plus 202 rejected records. Those categories may account for the difference, but the supplied text does not explain the totals fully. The final count and its precise inclusion rules remain unsettled in the material provided.
Final Counts and Fixes Ahead
The next useful check is the completed October dataset, including a clear account of included, rejected and cross-checked records. The source’s estimate of about 17,000 records for October should be treated as a forecast until publication counts for the full month are available. Later updates can also show whether the slower October growth continued.
For the security impact, readers will need information beyond CVE totals: which affected products are exposed, the severity and exploitability of each flaw, whether fixes or mitigations are available, and how quickly organizations apply them. Updates to CISA’s exploited-vulnerability catalog may help track confirmed exploitation, but that catalog is not a complete measure of attacks. Anthropic’s patch figures may also change as maintainers release fixes or report them back.
Until those details are available, the supported conclusion is limited: public vulnerability disclosures rose sharply in the source’s 2026 count, and one AI lab reports a large difference between vulnerabilities it reported and patches it knows about. How much AI contributed, how many flaws remain exposed, and whether exploitation is rising at a comparable pace are still open questions.
Key Questions
How many CVE records were published in October 2026?
The source counts 13,934 records from Oct. 1–25. It also gives an NVD total of 13,766 October records plus 202 later rejected records, without fully explaining how those figures relate. The full-month count was not yet available in the supplied material.
Does the increase prove AI is finding most vulnerabilities?
No. The source says only 1.4% of October records explicitly credit an AI lab or AI security firm, while 54% name no finder. Those gaps mean the public records cannot establish AI’s overall role.
What does Anthropic say about patching?
Anthropic says it reported 6,157 vulnerabilities to maintainers and that 516 are patched to its knowledge. This is the company’s reported tracking, not an independent count of every fix.
Do more CVE records mean more attacks?
Not by themselves. CVE records count disclosed vulnerabilities, not confirmed attacks. The source cites separate reporting about attackers using AI agents against older bugs, but the supplied figures do not link that activity to the October CVE increase.
Source: ThorstenMeyerAI.com
