🔍 Read the full analysis: The CVE Trendline: AI, Bug Hunters, And Delayed Patches on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
The source’s analysis of CVE records reports 13,934 new records published from Oct. 1 through Oct. 25, 2026, more than three times October 2025’s full-month total. The records do not establish how much AI contributed to discovery, while Anthropic says only 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge.
An analysis of public vulnerability records found 13,934 new CVEs published from October 1 through 25, 2026, compared with 4,389 in all of October 2025, while the available data does not establish how much artificial intelligence drove the increase. The figures, compiled from the U.S. National Vulnerability Database and CVE.org by Thorsten Meyer, also highlight a potential delay between discovery and remediation: Anthropic reports that 516 of 6,157 vulnerabilities it disclosed to open-source maintainers are patched to its knowledge.
The 13,934 October figure includes 13,766 records still listed as CVEs and 202 later rejected, according to the analysis, which cross-checked NVD publication records against CVE.org. The source says the data was retrieved on October 26 and counted by publication date. Its comparison is not like-for-like: October 2026 covers 25 days, while the October 2025 figure covers the full month.
Other monthly counts in the analysis show 15,074 records in September 2026, 12,719 in August, 9,919 in July and 8,001 in June. The author calculates that the daily publication rate rose by 20% from June to July, 28% from July to August and 22% from August to September; the increase for October so far was about 11%. The article projects that October could end near 17,000 records if its pace holds, but that is a projection, not a final count.
The increase is concentrated among several large vendors and vulnerability-recording organizations. Microsoft had 1,455 October records in the source’s comparison, against 180 in October 2025; Oracle had 1,078, against 78. GitHub rose from 276 to 1,159 and VulnCheck from 163 to 2,085. These are counts of records, not a direct measure of the number of distinct security incidents or attacks.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
Why Patch Delays Matter
A high rate of disclosure does not, by itself, show that software is becoming less secure or that attackers are exploiting more bugs. It does mean that maintainers and security teams face more records to review, and that users may need to track fixes across many products. The practical risk depends in part on whether affected software is exposed, how severe a flaw is, and how quickly a reliable patch reaches systems.
Anthropic’s reported remediation figures draw attention to that second part of the process. The company says it has reported 6,157 vulnerabilities to maintainers and knows of patches for 516. That is about one in twelve, based on the company’s accounting. The source does not provide a comparable patch-status measure across all CVEs, so this figure should not be read as the overall share of vulnerabilities that remain unpatched.
The analysis also says the CISA Known Exploited Vulnerabilities catalog, a public list of vulnerabilities known to be exploited in attacks, grew much less than the CVE publication count. It gives a figure of 245 additions for all of 2025, but the provided material does not include the corresponding 2026 total. The available figures therefore do not show that exploitation has risen at the same rate as disclosure.
Products Worth Considering
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
As an affiliate, we earn on qualifying purchases.
How the October Count Was Built
Meyer says he queried NVD’s CVE API 2.0 for records published from January 2022 onward, using publication dates and including all record statuses. He then checked October IDs against CVE.org. The records provide a way to track disclosures, but they do not consistently identify who first found a vulnerability or whether AI tools were involved.
Of the 13,934 October records examined, 6,346, or 46%, named a finder, according to the analysis. It says 200 records, or 1.4%, explicitly credited an AI lab or AI security firm as a finder, reporter or tool: 123 mentioned Anthropic or Claude, 65 named security firms including AISLE, XBOW or depthfirst, and 16 named OpenAI. The author describes this as a floor rather than a complete measure because many records omit a finder.
The source also cites Anthropic’s disclosure dashboard as of October 2: Claude models had identified 29,439 candidate vulnerabilities; external firms reviewed 6,123 and confirmed 92.7% as real, according to Anthropic. The company says 6,157 had been reported to maintainers. Separately, OpenAI’s Patch the Planet program with Trail of Bits reports “hundreds of security issues” across 19 open-source projects, each reviewed by people. These are company-reported program figures, not a complete count of AI-assisted vulnerability discoveries.
What the CVE Data Cannot Show
The publication count alone cannot establish how many vulnerabilities AI systems found. More than half of October’s records did not name a finder, and some findings credited to people or organizations may have involved tools without saying so. Conversely, the presence of an AI company in a record does not by itself reveal how much AI contributed to the discovery.
It is also unclear from the supplied figures how many of the October vulnerabilities were exploitable in real-world conditions, how many received patches after the source’s review, or how many affected systems remain exposed. A CVE publication is not evidence that attackers exploited the flaw. The source discusses CISA’s exploited-vulnerability catalog but does not provide its current 2026 total, making a direct comparison with this year’s CVE trend incomplete.
The October count is still partial, and the author’s month-end estimate depends on the rate continuing. The source attributes the vendor increases to Microsoft, Oracle, GitHub and VulnCheck counts, but does not establish a single cause for the overall rise or quantify the impact of AI across the industry.
Final October Counts and Patch Status
The next clear checkpoint is a complete October publication count, which will show whether the month approaches Meyer’s projection of about 17,000 records. That estimate should be treated as provisional until all dates and record statuses are included and the figures are checked against the source databases.
For organizations using affected products, the immediate operational step is to consult vendor advisories and apply relevant fixes, while tracking vulnerabilities that have no patch or require mitigation. The source material does not identify a single forthcoming government or industry report that will settle how much AI contributed. Better disclosure of discovery methods and consistent patch-status reporting would help distinguish a rise in reported bugs from a rise in exploitable risk.
Key Questions
How many CVE records were published in October 2026?
The source analysis counted 13,934 records from October 1 through 25. It says 13,766 remained listed as CVEs and 202 had later been rejected. The count is partial, not a full-month total.
Does the increase prove AI is finding most vulnerabilities?
No. The records do not establish that. The analysis says 1.4% explicitly credited an AI lab or AI security firm, while 54% did not name a finder. That leaves substantial uncertainty about AI’s role.
How many vulnerabilities reported by Anthropic were patched?
Anthropic reported that 516 of 6,157 vulnerabilities it disclosed to maintainers were patched to its knowledge. This is the company’s reported status for its own findings, not a measure of all CVEs.
Does a CVE record mean a vulnerability was exploited?
No. A CVE record documents a vulnerability disclosure; it does not show that attackers used the flaw. The source points to CISA’s Known Exploited Vulnerabilities catalog as a separate public measure of vulnerabilities known to have been exploited.
Source: ThorstenMeyerAI.com
