🔍 Read the full analysis: What CVE Data Shows About AI, Bug Hunters, And The Patch Gap on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A data analysis published Oct. 26 reports 13,934 CVE records from Oct. 1–25, 2026—3.2 times the total recorded in all of October 2025. The figures show a sharp rise in disclosed vulnerabilities, but CVE records do not establish how many bugs AI found; patching appears to be a major gap, based on Anthropic’s reported figures.
A data analysis published October 26 counted 13,934 new CVE records from October 1 through 25, 2026, or 3.2 times the 4,389 records published during all of October 2025. The figures show a rapid increase in disclosed vulnerabilities, but they do not establish how many were found with artificial intelligence; the analysis argues the more immediate concern is whether reported bugs are being fixed.
The author says the figures came from queries to the U.S. National Vulnerability Database and a cross-check against CVE.org records. The count includes 13,766 records published in October and 202 later rejected, for 13,934 total. The analysis reports that 98% of October records carry a 2026 ID, with a median of 15 days between reserving an ID and publication. That suggests most were not simply old records released in a backlog dump, though it does not identify when each underlying flaw was discovered.
The monthly pace rose from 8,001 records in June to 9,919 in July, 12,719 in August and 15,074 in September. October’s 557 records per day through the 25th were higher than September’s 502 per day, but the author estimates the rate of growth slowed: monthly daily volume increased about 20% from June to July, 28% from July to August, 22% from August to September and about 11% in October so far. A projection that October could end near 17,000 is the author’s estimate, not a final count.
The increase is concentrated among a handful of organizations. The analysis counts 1,455 Microsoft records in October, compared with 180 a year earlier; Oracle rose from 78 to 1,078, while GitHub rose from 276 to 1,159 and VulnCheck from 163 to 2,085. Microsoft’s October total includes a Patch Tuesday release that SecurityWeek reported fixed 1,413 CVEs. These figures describe published records, not necessarily distinct newly discovered bugs or vulnerabilities being actively exploited.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Fix Queue Matters More
A larger disclosure count can help defenders identify and address flaws, but publication alone does not make software safer. The analysis cites Anthropic’s dashboard as reporting 6,157 vulnerabilities disclosed to maintainers, of which the company said 516 were patched to its knowledge—about one in twelve. That is a company-reported snapshot, not an independently audited measure, and it applies to Anthropic’s reported findings rather than all CVEs.
The gap matters because maintainers must assess reports, develop fixes and distribute them to users, who then need to install updates. If disclosure grows faster than those steps, organizations may face a longer queue of known issues. The supplied source also says attackers use low-cost AI agents against older bugs, citing NorForge and Reuters, but it provides no figures for the scale or consequences of that activity. The data supports concern about repair capacity; it does not establish that the new CVE volume has produced a matching rise in attacks.
Popular right now
iRobot Roomba 105 Vac Robot Vacuum
TCL 85-Inch QM6K Series QLED Mini LED 4K HDR Smart Google TV
LG 85-inch QNED75B Mini LED Smart TV Bundle with HDMI and CPS Protection Plan
As an affiliate, we earn on qualifying purchases.
What CVE Counts Can Show
A CVE is a public identifier for a disclosed vulnerability. The source explains that records are generally published through a CVE Numbering Authority, often a vendor, as part of coordinated disclosure. An attacker who finds a flaw does not file a CVE; a later disclosure may document a defender’s response to a bug that was already exploited. For that reason, a rise in CVEs is not itself a count of attacks, nor proof that defenders found every vulnerability in the period.
The attribution data is incomplete. Of the 13,934 October records examined, 6,346, or 46%, name a finder. The author says 200 records, or 1.4%, explicitly credit an AI lab, AI model or AI security firm. That is a count of explicit credits in the records, not a reliable estimate of AI’s total contribution. The analysis also reports that Anthropic’s dashboard listed 29,439 candidate vulnerabilities identified by Claude models as of October 2; external firms reviewed 6,123 and confirmed 92.7% as real. The source says those findings had so far generated 219 CVE records and 365 GitHub advisories.
AI Attribution Is Incomplete
The records do not show how much AI contributed to finding the vulnerabilities, because more than half list no finder and the source’s AI-credit count relies on explicit attribution. It is also unclear how many reported bugs have been fixed beyond Anthropic’s own knowledge, how quickly fixes reach users, and whether the patch rate is changing. The supplied source begins to compare CVE growth with CISA’s Known Exploited Vulnerabilities catalog, saying the catalog added 245 entries in all of 2025, but the text provided ends before giving the later comparison. It therefore does not support a complete account of current exploitation trends.
The source also reports Anthropic’s claim that a Chinese open-weight model can build exploits end to end with weak safeguards. No supporting technical detail or independent assessment is included in the material provided, so that claim cannot be treated here as independently verified. The October figures are a snapshot through the 25th, not a final monthly total.
Watch Final Counts and Fixes
The October CVE total will become clearer after the month ends and records are reconciled. The author’s estimate of about 17,000 records assumes the observed pace continues and should not be read as a confirmed count. Further comparisons with CISA’s exploited-vulnerability catalog could help show whether known exploitation is moving at a similar pace, but the supplied material does not provide the complete current figures.
For organizations, the near-term measure is not only how many vulnerabilities are disclosed, but whether maintainers publish fixes and users apply them. More complete reporting on patch status, exploitation and finder attribution would help distinguish a larger discovery pipeline from a growing threat to systems in use.
Key Questions
How many CVE records were counted in October?
The analysis counted 13,934 records from October 1–25, 2026, including 13,766 published records and 202 later rejected. The figure is not a final count for the full month.
Does the CVE increase prove AI is finding most of the bugs?
No. The analysis says only 1.4% of October records explicitly credit an AI lab or AI security firm, while 54% name no finder. Those gaps mean CVE records cannot establish AI’s total role.
What is the reported patch gap?
Anthropic’s dashboard, as described by the source, says 516 of 6,157 vulnerabilities reported to maintainers were patched to the company’s knowledge. That is a company-reported figure for its own findings, not a measure of all disclosed vulnerabilities.
Do the figures show that attacks are rising at the same rate?
No such conclusion is established by the figures provided. CVE disclosures measure published records, not attacks, and the source text does not include a complete current comparison with CISA’s Known Exploited Vulnerabilities catalog.
Source: ThorstenMeyerAI.com
