🔍 Read the full analysis: The CVE Climb: AI, Security Researchers, And The Patch Gap on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The source reports 13,934 CVE records published from October 1 through 25, 2026, and 88,772 so far this year. Its figures point to a sharp increase in disclosures, concentrated among a few organizations, while incomplete attribution makes AI’s contribution difficult to measure. Anthropic says 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge, highlighting the gap between discovery and fixes.
CVE disclosures have climbed sharply: an analysis published October 26 reports 13,934 vulnerability records for October 1–25, 2026, and 88,772 for the year to date. The figures show more bugs being publicly recorded, but do not establish how much artificial intelligence contributed or how many disclosed issues remain exploitable; the source says only 516 of 6,157 vulnerabilities Anthropic reported to maintainers are patched to its knowledge.
The analysis says it queried the U.S. National Vulnerability Database (NVD) by publication date and cross-checked October IDs against CVE.org. It reports 13,934 records for October 1–25, compared with 4,389 records across all of October 2025. Its stated year-to-date count is 88,772 CVEs, 78% above the total for all of 2025. These are publication counts, not a direct measure of newly exploitable software or successful attacks.
The source reports that 46% of October records named a finder, while 1.4% explicitly credited an AI lab or AI security firm. It says the increase is concentrated among a small number of organizations: Microsoft accounted for 1,455 records in October, versus 180 in October 2025; Oracle went from 78 to 1,078. Such totals reflect disclosure and numbering activity as well as underlying discoveries, so they should not be read as a count of attacks.
Patch data in the source underscores the difference between finding and fixing vulnerabilities. Anthropic’s disclosure dashboard, as cited in the analysis, listed 6,157 vulnerabilities reported to maintainers and 516 patched to the company’s knowledge as of October 2. OpenAI’s Patch the Planet program with Trail of Bits reported “hundreds of security issues” across 19 open-source projects, with the issues reviewed by people, according to the source.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
More Disclosures, Slower Remediation
A rise in published CVEs can give software teams more issues to triage and patch, but the count alone does not reveal how many affect a particular organization or are being exploited. The operational concern is whether maintainers can confirm, prioritize and distribute fixes quickly enough. The source’s Anthropic figures suggest reported discoveries can outpace publicly known remediation, though the company’s patch count is based on its own knowledge and does not capture every downstream fix.
The source also cites attackers’ use of low-cost AI agents against older vulnerabilities, attributing that account to NorForge and Reuters. That points to a possible risk beyond newly discovered bugs: existing flaws may remain useful to attackers when software is not updated. However, the material provides no comparable attack-rate series demonstrating that exploitation rose in step with CVE publication.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
Amazon Kindle Scribe Colorsoft 64GB (1st Generation)
As an affiliate, we earn on qualifying purchases.
How the October Counts Were Built
The analysis says it retrieved NVD CVE API 2.0 records for publication dates from January 2022 onward, with data retrieved October 26, 2026, at 07:16 UTC. It cross-checked October IDs on CVE.org and says the sources matched on 13,766 records, with another 202 records later rejected. The article’s headline October figure of 13,934 is the total it reports for October 1–25; the source also gives a separate 13,766 figure for October records in its cross-check discussion. Those different totals and scopes make exact comparisons worth treating carefully.
Monthly totals in the source rise from 8,001 in June 2026 to 9,919 in July, 12,719 in August and 15,074 in September. It describes the daily-rate increases through September as 20% to 28%, then estimates an approximately 11% increase in October. Its projection that October could finish near 17,000 is explicitly an estimate, not a completed monthly count. The source also says 98% of October records carried a 2026 ID and the median time from ID reservation to publication was 15 days.
A CVE is a public identifier and disclosure record, generally assigned through a CVE Numbering Authority. The source argues that this makes the published stream largely a defender-side record: attackers do not file CVEs, though a record can be created after a vulnerability has already been exploited. Publication volume therefore measures disclosure activity, not the number of active attacks.
AI Attribution and Patch Status
The CVE records do not establish AI’s overall contribution. According to the source, 54% of October records name no finder, and only 1.4% explicitly credit an AI lab or security firm. The author describes that credited share as a floor, not a full estimate; records may omit tools or researchers involved in discovery.
Patch status is also incomplete. Anthropic’s figure is “to its knowledge,” and the source does not provide a common, independently verified status for all disclosed vulnerabilities. The supplied material ends while discussing CISA’s Known Exploited Vulnerabilities catalog and does not include its full comparison with the CVE totals. It therefore does not support a complete account of whether confirmed exploitation is accelerating alongside disclosures.
Track Fixes and Exploitation Data
The next useful indicators are completed monthly CVE counts, updated records of maintainer fixes and additions to CISA’s Known Exploited Vulnerabilities catalog. These can help distinguish a rise in publication activity from changes in known exploitation, while still measuring different parts of the security picture.
For organizations, the immediate task is to check whether disclosed issues affect their software, apply available vendor fixes and follow advisories as details change. The source’s projected October total near 17,000 remains only a forecast; the final count and the extent of remediation are not yet established in the supplied material.
Key Questions
How many CVEs were published in October 2026?
The source reports 13,934 records from October 1 through 25. It also describes a cross-check with 13,766 records plus 202 later-rejected records, so the figures refer to different parts of its accounting and should not be treated as interchangeable without the underlying data.
Does the increase prove AI is finding most vulnerabilities?
No. The source says only 1.4% of October records explicitly credited an AI lab or AI security firm, while 54% named no finder. That leaves AI’s actual contribution uncertain.
How many Anthropic-reported vulnerabilities were patched?
Anthropic’s dashboard, as reported by the source, listed 516 patched out of 6,157 reported to maintainers as of October 2. The source qualifies the patched count as being to Anthropic’s knowledge.
Do more CVEs mean more successful cyberattacks?
Not by themselves. CVE totals count published vulnerability records; they do not measure successful attacks. The supplied material does not provide a complete exploitation comparison for 2026.
Source: ThorstenMeyerAI.com
