🔍 Read the full analysis: What The Latest CVE Data Says About AI And Patch Timelines on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
A source review of US National Vulnerability Database and CVE.org records found 13,934 CVEs published from Oct. 1–25, 2026, more than three times the total for all of October 2025. The records do not establish how much AI contributed to finding the flaws, while Anthropic reports that just 516 of 6,157 vulnerabilities it disclosed to maintainers are patched to its knowledge.
A review of vulnerability records published through Oct. 25, 2026, counted 13,934 new CVEs—more than three times the 4,389 recorded during all of October 2025—while finding that public records do not show how much artificial intelligence contributed to the increase. The figures point to a second concern: Anthropic says only 516 of 6,157 vulnerabilities it reported to open-source maintainers had been patched to its knowledge.
The review queried the US National Vulnerability Database (NVD) by publication date and cross-checked October records against CVE.org. It reports 13,934 records for Oct. 1–25, or 557 per day on average. Separately, it says NVD and CVE.org agreed on 13,766 October records plus 202 later rejected. The source does not fully explain the difference between those two reported totals, so they should not be treated as interchangeable.
The increase is concentrated among a small number of organizations, according to the review. Microsoft had 1,455 October records, compared with 180 in October 2025; Oracle had 1,078, compared with 78. GitHub rose from 276 to 1,159 and VulnCheck from 163 to 2,085. The source attributes much of Microsoft’s total to its October Patch Tuesday, which SecurityWeek reported fixed 1,413 CVEs. These counts describe published records, not necessarily newly discovered flaws or separate incidents.
Attribution data is incomplete. Of the 13,934 records examined for October, 6,346 named a finder; the review says 200 explicitly credited an AI lab or AI security firm. That includes 123 attributed to Anthropic or Claude, 65 to AI security firms and 16 to OpenAI. The author calls this a floor, since many records do not name a finder and the data cannot establish whether AI was used without being credited.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Fix Queue Behind the CVE Surge
The growth in published CVEs matters because organizations must determine which flaws affect their systems, assess exposure and apply fixes. But a larger disclosure count alone does not establish a matching rise in attacks. CVEs document vulnerabilities; they do not, by themselves, show whether a flaw is being exploited, how many systems are affected or whether AI found it.
The reported patch figures highlight a potential delay after disclosure. Anthropic’s dashboard, as summarized by the source, lists 6,157 vulnerabilities reported to maintainers and 516 patched to the company’s knowledge—about one in twelve. That is a company-reported status, not an independently verified count of all fixes. Even so, it underscores why patch availability and deployment are central to practical risk: identification does not protect systems until a remedy is developed and applied.
The source also cites reporting by NorForge and Reuters that attackers are using low-cost AI agents against older vulnerabilities. That account suggests AI-enabled attacks may involve known, unpatched flaws rather than only newly discovered bugs. The supplied material does not include enough detail to quantify those attacks or connect them to the October CVE totals.
Popular right now
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, KSM150PS, Almond Cream
Philips 4400 Series Fully Automatic Espresso Machine with LatteGo Milk System
Vitamix Propel Series 510 Professional-Grade Blender, 3 Programs, Black
As an affiliate, we earn on qualifying purchases.
What the October Counts Measure
A CVE is a public identifier for a disclosed vulnerability. The source explains that records are generally published through a CVE Numbering Authority, often after a vendor coordinates a disclosure. That process means the published record usually reflects a defender’s disclosure, not the identity of whoever first found the flaw. An attacker who discovers a vulnerability does not have to file a CVE; a later coordinated disclosure can create a record after the flaw is known.
The review compared monthly publication counts and found 8,001 CVEs in June 2026, 9,919 in July, 12,719 in August and 15,074 in September. It says the daily rate grew by 20% from June to July, 28% to August and 22% to September, then by about 11% in October so far. Those figures describe the rate of record publication, not the pace of AI development or exploitation.
The source estimates October could end near 17,000 records if the pace continues. That is a projection, not an observed total. It also says 98% of the October records carried 2026 identifiers and the median time between reserving an ID and publication was 15 days, evidence the author uses to argue that the increase is not simply a backlog of older records.
“6,157 have been reported to maintainers.”
— Anthropic, as summarized in its disclosure dashboard
What the Records Cannot Establish
The public data does not identify a finder for 54% of October records, according to the review. Its count of 200 AI-related attributions therefore cannot measure all AI-assisted discovery; it records only cases explicitly credited in the CVE entries. Nor does a CVE count reveal whether AI was used internally by a vendor, researcher or security team.
The supplied material gives only a partial comparison with the CISA Known Exploited Vulnerabilities catalog: it says the catalog added 245 entries in all of 2025, but the text ends before giving the corresponding 2026 figure. It therefore cannot support a complete comparison of exploited vulnerabilities with total CVE publications. Details about the NorForge and Reuters reporting, including the scale of the reported AI-assisted attacks, are also not provided.
The reported patch count is qualified: Anthropic says 516 are patched “to its knowledge.” The source does not specify how recently maintainers’ status was checked or whether fixes were deployed by affected users. The discrepancy between the two October totals in the review—13,934 for the first 25 days and 13,766 for October—also remains unexplained in the supplied material.
More Data Needed on Fixes
The immediate next step is to track the completed October publication count and compare it with the same date ranges in earlier years, using consistent sources and definitions. The review’s estimate of nearly 17,000 records is conditional on the pace holding and should not be read as a final total.
For security teams, the more useful follow-up is whether affected vendors publish fixes, how quickly those fixes become available and whether CISA adds vulnerabilities to its exploited catalog. Researchers and maintainers will also need clearer disclosure practices if users are to understand when AI contributed to discovery. The data described here establishes a record-publication surge; it does not yet settle AI’s share of it or the scale of resulting attacks.
Key Questions
How many CVEs were reported in October 2026?
The review counted 13,934 records from Oct. 1–25. It separately reports 13,766 October records in an NVD and CVE.org cross-check, plus 202 later rejected. The source does not explain the difference, and the full-month figure was not yet available.
Do the figures prove AI caused the CVE increase?
No. Only 200 records explicitly credited an AI lab or AI security firm, while 54% named no finder. That makes the explicit count incomplete and does not establish how often AI was used without attribution.
What does Anthropic report about patching?
Anthropic’s dashboard, as summarized in the review, says it reported 6,157 vulnerabilities to maintainers and that 516 were patched to its knowledge. This is the company’s reported status, not an independently verified measure of all patches or deployments.
Does a rising CVE count mean attacks are rising at the same rate?
No. CVE publication counts measure disclosed and recorded vulnerabilities, not confirmed exploitation. The supplied source mentions CISA’s exploited-vulnerability catalog but does not provide a complete 2026 comparison.
Source: ThorstenMeyerAI.com
