🔍 Read the full analysis: Exploring The Link Between AI, CVE Discovery, And Patch Delays on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A review of NVD and CVE.org records found 13,934 new CVE records published from October 1 to 25, 2026, while the year’s total had reached 88,772. The data does not establish how much AI contributed to discovery; the clearest concern is the time between reporting vulnerabilities and shipping fixes.
A review of U.S. National Vulnerability Database and CVE.org records found 13,934 new CVE records published from October 1 to 25, 2026, as researchers and vendors disclosed more software flaws. The figures show a steep increase in published vulnerabilities, but do not establish how much artificial intelligence drove discovery; separate figures from Anthropic point to a patching gap after vulnerabilities are reported.
The review, published by ThorstenMeyerAI.com on October 26, counted records by publication date and cross-checked October entries against CVE.org. It reported 88,772 CVE records so far in 2026, 78% more than the 40,000-plus recorded across all of 2025, according to the source’s comparison. October’s first 25 days produced 13,934 records, compared with 4,389 across all of October 2025. The source says the NVD and CVE.org totals agree on 13,766 October records, with 202 additional records later rejected; its 13,934 figure is the October 1–25 count.
The monthly rate has risen, though the source’s calculation indicates that growth slowed in October. Records per day rose from 267 in June to 320 in July, 410 in August and 502 in September. October’s rate through the 25th was 557 per day. The author estimates that the month could end near 17,000 records if that pace holds, but labels this a projection, not a final count.
The increase is concentrated among a small number of large publishers and numbering organizations. Microsoft had 1,455 October records, up from 180 in October 2025; Oracle had 1,078, compared with 78 a year earlier. GitHub’s count rose from 276 to 1,159, and VulnCheck’s from 163 to 2,085. The Linux kernel’s count rose from 660 to 925. These counts reflect records published under those organizations’ names, not necessarily the number of flaws each independently discovered.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Delay Between Reports and Repairs
A larger disclosure count does not by itself show that attackers have more newly usable exploits or that software is becoming less secure. A CVE is a public record of a vulnerability, and the source notes that records commonly follow coordinated disclosure by a vendor or other CVE Numbering Authority. The count reflects publication activity as well as underlying flaws; it is not a direct measure of active attacks.
The operational concern is whether maintainers can assess and fix reported flaws quickly. Anthropic says it has reported 6,157 vulnerabilities to open-source maintainers and knows of 516 patched, roughly one in twelve. That figure is based on the company’s knowledge and should not be read as a complete audit of every project’s status. Still, it highlights why the period between discovery, disclosure and a deployed fix matters to software users and organizations responsible for updates.
AI may help find defects, but the public record does not establish its share of the increase. Nor does a rise in CVEs alone establish a matching rise in exploited vulnerabilities. Readers should distinguish among flaws found, flaws published, flaws fixed and flaws known to be exploited: they are related measures, but they are not interchangeable.
Popular right now
LG 85-inch QNED75B Mini LED Smart TV Bundle with HDMI and CPS Protection Plan
Shark Navigator Robot Vacuum with Self-Empty Base, Dark Grey (RV2120AE)
Vitamix 5200 Professional-Grade Blender, 64 oz. Container, Black
As an affiliate, we earn on qualifying purchases.
What the CVE Counts Measure
The source queried the NVD’s CVE API for records published from January 2022 onward and cross-checked October records against CVE.org. It says 98% of October records carry 2026 IDs, and the median time between reserving an ID and publishing it was 15 days. Those observations argue against the month’s increase being mainly an older backlog released all at once, although they do not identify the cause of the broader rise.
A CVE record is not a record of who first found a flaw. Of 13,934 October records reviewed, 6,346, or 46%, named a finder. The author counted 200 records, or 1.4%, that explicitly credited an AI lab or AI security firm as a finder, reporter or tool: 123 mentioning Anthropic or Claude, 65 naming security firms such as AISLE, XBOW or depthfirst, and 16 naming OpenAI. The author describes this as a floor, not an estimate, because many records do not identify a finder.
Anthropic’s dashboard, as reported by the source, listed 29,439 candidate vulnerabilities found by Claude models as of October 2. External firms reviewed 6,123 and confirmed 92.7% as real, according to Anthropic; 6,157 had been reported to maintainers. The source says those findings corresponded to 219 CVE records and 365 GitHub advisories at the time. OpenAI’s Patch the Planet program with Trail of Bits reported “hundreds of security issues” across 19 open-source projects, with each reviewed by hand. These company-reported figures describe different stages and scopes, so they cannot be added directly to the public CVE totals.
“That is my projection, not a count.”
— Thorsten Meyer, ThorstenMeyerAI.com
The public records do not show how much AI contributed to the 2026 increase. More than half of October’s CVE records did not name a finder, and an explicit AI credit may not capture every use of AI in a research or disclosure process. The 1.4% figure is therefore a count of records that explicitly mention an AI lab or security firm, not a reliable estimate of AI’s total role.
Patch status is also incomplete: Anthropic says 516 of its 6,157 reported vulnerabilities are patched “to its knowledge.” The source does not provide a common, independently verified status measure across vendors and maintainers, or enough detail to establish why the remaining vulnerabilities have not been marked patched. It also cites growth in CISA’s Known Exploited Vulnerabilities catalog but the supplied material ends before giving the full comparison, so no conclusion about the scale of exploitation relative to CVE growth can be drawn here.
The source also reports Anthropic’s assessment that a Chinese open-weight model can build exploits end to end with weak safeguards. That is an attributed company assessment; the supplied material gives no independent evaluation details or evidence sufficient to assess the model’s capabilities. Claims that restrictions primarily slow defenders, or that AI is broadly changing attacker capabilities, remain interpretations rather than findings established by the CVE counts.
Tracking Fixes and Exploitation
The next useful measures are final October publication totals, updated patch-status data from maintainers and clearer evidence about whether reported flaws are being exploited. The source’s estimate of roughly 17,000 October records should be checked against the completed month rather than treated as an established outcome.
For organizations using affected software, the published totals alone do not identify which products need action. Security teams and maintainers need to consult the relevant vendor advisories, determine whether a flaw applies to their systems, and follow available remediation guidance. Further reporting will need to separate AI-assisted discovery from other research methods and compare disclosure trends with verified patching and exploitation data.
Key Questions
How many CVE records were published in October 2026?
The review counted 13,934 records from October 1 to 25. It estimated the full month could approach 17,000 if that pace continued, but that is a projection, not a final total.
Does the increase prove AI is finding most vulnerabilities?
No. The records do not identify a finder in 54% of cases. The review found explicit AI lab or security-firm credit in 1.4% of October records, but says that is a floor rather than an estimate of all AI involvement.
How many vulnerabilities reported by Anthropic were patched?
Anthropic reported that it knew of 516 patched vulnerabilities among 6,157 it had reported to maintainers. The status is based on the company’s knowledge and is not presented as an independent audit.
Does a higher CVE count mean more attacks are happening?
Not by itself. CVE publication counts measure disclosed vulnerability records, not confirmed attacks. Assessing exploitation requires separate evidence, such as verified additions to catalogs of vulnerabilities known to be exploited.
Source: ThorstenMeyerAI.com
