🔍 Read the full analysis: AI, Vulnerability Finders, And The Race To Patch CVEs on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A review of U.S. National Vulnerability Database and CVE.org records found 13,934 new CVE records published from Oct. 1–25, 2026, 3.2 times the total for October 2025. The figures do not identify AI as the cause of most discoveries, while Anthropic says only 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge.
New CVE records rose sharply in October 2026, with 13,934 published from Oct. 1–25, compared with 4,389 across all of October 2025, according to a review of U.S. National Vulnerability Database and CVE.org data. The increase comes as AI tools are being used to find software flaws, but the records do not establish how much AI contributed—and a separate disclosure tally points to patching, not discovery alone, as a major unresolved challenge.
The review counted CVE records by publication date in the National Vulnerability Database’s CVE API and cross-checked October entries against CVE.org. It found 13,766 October records that remained active and 202 that were later rejected, for 13,934 records in the period. The data were retrieved on Oct. 26. The article also reports 88,772 records so far in 2026, already 78% more than the full-year 2025 total; that comparison uses a partial year against a full one.
The increase is concentrated among a relatively small number of organizations. Microsoft accounted for 1,455 October records, up from 180 in October 2025; Oracle rose from 78 to 1,078, and GitHub from 276 to 1,159. The source attributes most of Oracle’s October records to a single day. It says the Linux kernel’s count rose from 660 to 925, a smaller increase than those reported for several large vendors and vulnerability clearinghouses.
The data offer limited insight into who found the underlying flaws. Of the October records, 6,346, or 46%, name a finder. The review identified 200 records—1.4%—that explicitly credit an AI lab or AI security firm. The source cautions that this is a floor, not a complete measure: many records omit finder information, and AI assistance may not be identified in the disclosure.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
Why the Patch Queue Matters
A higher disclosure count can mean more flaws are being found and documented; it does not, by itself, show that more software is being exploited. A CVE is a vulnerability disclosure record, not a measure of attacks in progress. The report says attackers do not file CVEs, and that some records document defenders’ responses to flaws, including cases first found through exploitation.
The practical concern is what happens after discovery. Anthropic’s dashboard, as cited in the source, lists 6,157 vulnerabilities reported to maintainers and says 516 were patched to the company’s knowledge—about one in twelve. That figure is Anthropic’s account of its own reporting and follow-up, not a complete tally of all vulnerabilities or all fixes. Still, it illustrates why a faster discovery pipeline can leave maintainers facing more work than they can promptly complete.
The source also points to reporting by NorForge and Reuters about attackers using inexpensive AI agents on older vulnerabilities. That claim underlines the risk of unpatched software, but the material supplied here does not quantify how many attacks involved those tools. For organizations, the immediate takeaway is to track vendor advisories and apply available fixes, rather than treating the CVE total as a direct measure of active danger.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Logitech MX Mechanical Mini Mac Wireless Keyboard Low-Profile – Space Grey
Canon SELPHY CP1500 Wireless Compact Photo Printer with RP-108 Ink and Paper Set
As an affiliate, we earn on qualifying purchases.
How October’s CVE Count Was Built
The source’s review covers monthly CVE publication records from January 2022 onward, using the NVD CVE API and publication dates. It reports that 98% of October records carry a 2026 ID and that the median time from ID reservation to publication was 15 days. Those details weigh against the idea that the month’s count was simply a release of a large backlog, though they do not explain the full rise.
Daily publication rates increased from 267 in June to 320 in July, 410 in August and 502 in September, according to the source. For Oct. 1–25, it reports an average of 557 per day. The source describes the October increase in the daily rate as about 11%, slower than the preceding monthly gains. Its estimate that the month could end near 17,000 records is a projection, not a final count.
AI security programs add evidence that automated tools are involved in vulnerability research, but their figures do not map directly onto CVEs. Anthropic says external reviewers confirmed 92.7% of 6,123 candidate vulnerabilities its models found, and that 6,157 were reported to maintainers. The source says those findings corresponded so far to 219 CVE records and 365 GitHub advisories. OpenAI’s Patch the Planet program with Trail of Bits reported “hundreds of security issues” across 19 open-source projects, with each issue reviewed by people.
What the Records Cannot Show
The source data do not establish what share of the CVE surge was caused by AI tools. More than half of October records name no finder, and an explicit AI credit may be absent even when a tool assisted research. The 200 records that do name AI labs or security firms therefore should not be treated as a complete count of AI-assisted discoveries.
It is also unclear from the material supplied how many newly disclosed vulnerabilities are being exploited, how quickly patches are reaching users across the full software ecosystem, or whether October’s pace will continue. The source says the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog grew, but the provided text ends after stating that it added 245 entries in 2025; it supplies no comparable 2026 figure. No direct comparison between the CVE surge and 2026 confirmed exploitation can be made from the information provided.
Finally, the 516 patched vulnerabilities are based on Anthropic’s knowledge, not an independent audit of every maintainer or deployment. The source does not give a complete timeline for when those fixes were released, adopted, or made available to users.
The Next Test Is Remediation
The October publication count will become clearer after the month closes and records are finalized. The source’s estimate of roughly 17,000 records depends on the pace holding and should not be read as a confirmed total. Further analysis would also need to examine how many records receive finder attribution, how many are linked to AI-assisted research, and how many are rejected or revised.
For maintainers and software users, the next measurable development is the arrival and adoption of fixes. The source does not identify a single forthcoming patch deadline or official review tied to the data. It does point to a continuing need for maintainers to assess reports, issue updates, and communicate exposure, while organizations apply fixes and monitor authoritative security advisories.
Whether AI makes discovery faster is only part of the story. The available evidence leaves the scale of AI’s contribution uncertain; the reported patch figures make clear that disclosure and repair are separate stages. The next useful indicators will be verified fixes and confirmed exploitation data, not CVE volume alone.
Key Questions
How many CVE records were published in October 2026?
The source review counted 13,934 records from Oct. 1–25. Of those, 13,766 remained active and 202 were later rejected. The full month’s total was not yet available in the source material.
Does the rise prove AI caused the increase?
No. The review found 200 October records, or 1.4%, explicitly crediting an AI lab or AI security firm. But 54% name no finder, so the records cannot establish AI’s full contribution.
What does the patch figure mean?
Anthropic says 516 of the 6,157 vulnerabilities it reported to maintainers had been patched to its knowledge. This is a company-reported figure, not a complete independent count of fixes across software.
Do more CVEs mean more attacks?
Not by themselves. CVEs record vulnerability disclosures; they do not measure attacks. The supplied material does not provide a comparable 2026 count of confirmed exploitation, so the relationship cannot be determined from these figures.
Source: ThorstenMeyerAI.com
