🔍 Read the full analysis: What’s Happening To CVEs? A Data Check On AI And Patch Gaps on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A review of public vulnerability records found 13,934 new CVE records published from Oct. 1–25, 2026, compared with 4,389 in all of October 2025. The increase is concentrated among a few major vendors and record coordinators; public CVE data does not establish how much AI contributed. The sharper concern is remediation: Anthropic says 516 of 6,157 vulnerabilities it reported to maintainers were patched, to its knowledge.
A review of public vulnerability records found 13,934 CVE records published from Oct. 1–25, 2026, more than three times the 4,389 recorded in all of October 2025, while available data does not show how much of the rise came from AI-assisted discovery. The figures, published by Thorsten Meyer on Oct. 26, also put attention on the next stage: Anthropic says just 516 of 6,157 vulnerabilities it reported to maintainers had been patched to its knowledge.
Meyer said he queried the U.S. National Vulnerability Database API for records by publication date and cross-checked October entries against CVE.org. The sources agreed on 13,766 records published during October to date, plus 202 records later rejected. His broader Oct. 1–25 tally is 13,934. The distinction reflects the counting and status treatment described in his review; CVE entries can be rejected after publication.
The pace has risen rapidly, though not at an accelerating rate throughout the period. The review counted 8,001 records in June, 9,919 in July, 12,719 in August and 15,074 in September. October’s reported daily rate through the 25th was 557, compared with 502 in September. Meyer estimated that October could end near 17,000 if that pace continued; that figure is a projection, not a final count.
The rise is uneven across organizations. Microsoft had 1,455 records in October, compared with 180 in October 2025; Oracle had 1,078, versus 78; GitHub had 1,159, versus 276; and VulnCheck had 2,085, versus 163. The review linked Microsoft’s total in part to its October Patch Tuesday, which SecurityWeek reported addressed 1,413 CVEs. The Linux kernel count rose from 660 to 925 over the same October-to-October comparison.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Patch Queue Behind the Surge
A higher CVE count means more publicly catalogued vulnerability records, but it does not by itself show that software became more dangerous at the same rate, that attackers are exploiting each flaw, or that AI found them. The count is shaped by publication and cataloguing practices, and a small number of vendors and coordinators account for a substantial portion of the rise described in Meyer’s review.
The more immediate operational concern is whether fixes reach users. Anthropic’s dashboard, as reported by Meyer, listed 6,157 vulnerabilities reported to maintainers and 516 patched to the company’s knowledge. That is a snapshot from the company, not an independently verified measure of all remediation. Still, it illustrates why discovery totals need to be read alongside patch status: a flaw that has been found can remain exposed while maintainers assess it, develop a fix and distribute updates.
Meyer also cited reporting by Reuters on NorForge and the use of inexpensive AI agents against older vulnerabilities. That points to a separate risk from the number of newly published CVEs: existing flaws may remain useful to attackers when systems are not updated. The cited material does not quantify the extent of such exploitation, so it cannot establish that the record increase has translated into a matching rise in successful attacks.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
What CVE Records Can Show
A CVE is a public identifier for a disclosed vulnerability. Records are generally issued through CVE Numbering Authorities, often vendors, as part of coordinated disclosure. As Meyer explains, the record identifies the vulnerability and its disclosure process; it does not necessarily identify who first discovered the flaw. A criminal who finds a bug would not ordinarily file a public CVE, while a later record may document a defensive response to an issue that was already exploited.
That limits what can be concluded about the people or tools behind this year’s discoveries. In Meyer’s review of 13,934 October records, 6,346, or 46%, named a finder. Two hundred records, 1.4% of the total, explicitly credited an AI lab or AI security firm as finder, reporter or tool. Meyer describes that number as a floor because many records do not name a finder; it is not a reliable estimate of AI’s share of discovery.
Anthropic reported 29,439 candidate vulnerabilities identified by Claude models on its dashboard as of Oct. 2. The company said external firms reviewed 6,123 and confirmed 92.7% as real; 6,157 had been reported to maintainers. Meyer’s account says those findings corresponded at that point to 219 CVE records and 365 GitHub advisories. OpenAI’s Patch the Planet program with Trail of Bits reported “hundreds of security issues” across 19 open-source projects, with each reviewed by people. These are program and company figures, not a complete census of AI-assisted security work.
““The curve is still climbing fast, but the acceleration has slowed, not run away.””
— Thorsten Meyer, in his Oct. 26 review
Limits of the Available Counts
The review’s figures are a dated snapshot, and the October total was not final when the data was retrieved on Oct. 26, 2026. The difference between the 13,934 Oct. 1–25 tally and 13,766 October records plus 202 later-rejected records also depends on how dates and record statuses are counted. Final monthly totals may change as records are updated or rejected.
Public CVE records do not reliably capture the identity of each finder, whether AI was used in the research, or whether a published vulnerability is being exploited. The cited material also gives no complete, comparable measure of how quickly all affected software is patched. Anthropic’s patch figure is limited to vulnerabilities its program reported and the company’s knowledge at the time.
The source material says CISA’s Known Exploited Vulnerabilities catalog added 245 entries in all of 2025, but does not provide the corresponding 2026 total or a full comparison for the period covered by the CVE counts. The available figures therefore do not support a firm conclusion about whether confirmed exploitation is rising at a similar pace.
Final October Counts and Patch Updates
The immediate next data point is a finalized October count, which can test Meyer’s estimate of roughly 17,000 records if the reported pace holds. Readers should also watch for later updates to the CVE records, since entries can be revised or rejected after publication.
For the practical risk picture, the key follow-up is whether maintainers release fixes and whether affected organizations apply them. Further reporting from CISA’s exploited-vulnerability catalog, vendors and security researchers may clarify how many newly disclosed flaws are being used in attacks. The figures presented so far do not settle that question or establish how much AI contributed to the increase.
Key Questions
How many CVE records were published in October 2026?
Meyer counted 13,934 records from Oct. 1–25. His cross-check found 13,766 records published in October to that point, plus 202 later rejected. The month was still in progress when the data was retrieved.
Does the rise prove AI is finding most vulnerabilities?
No. In Meyer’s review, 1.4% of October records explicitly credited an AI lab or AI security firm, but 54% did not name a finder. The records therefore cannot establish AI’s overall share.
What does the patch figure mean?
Anthropic said 516 of 6,157 vulnerabilities it reported to maintainers were patched to its knowledge. It is a company-reported snapshot for that set of disclosures, not a count of all vulnerabilities or a third-party audit.
Does a higher CVE count mean attacks have increased?
Not on its own. CVE publication totals measure disclosed records, not successful attacks. The source material does not provide a complete, matching exploitation measure for the period.
Source: ThorstenMeyerAI.com
