🔍 Read the full analysis: From AI To Bug Hunters: What’s Behind The CVE And Patch Gap Trends on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A review of vulnerability records found 13,934 new CVE records published from Oct. 1 through 25, 2026, more than three times October 2025’s full-month total. The figures do not show how much AI contributed to discovery, while the source reports that only 516 of 6,157 vulnerabilities Anthropic says it reported to maintainers are patched to its knowledge.
A review of public vulnerability records found 13,934 new CVE records published from Oct. 1 through 25, 2026—3.2 times October 2025’s full-month count—while figures cited in the review point to a substantial gap between reported bugs and completed fixes. The analysis, published by ThorstenMeyerAI.com on Oct. 26, says the records show a surge in disclosures but cannot establish how much artificial intelligence contributed to finding them.
The review says the October count is based on publication dates in the U.S. National Vulnerability Database (NVD), cross-checked against CVE.org. It reports 13,766 records published in October plus 202 later rejected; its table gives 13,934 records for Oct. 1–25. The author says the sources agree on the October record set. The different totals reflect the review’s reporting categories and date coverage, rather than a single final full-month count.
The monthly pace had climbed from 8,001 records in June to 9,919 in July, 12,719 in August and 15,074 in September, according to the analysis. For Oct. 1–25, it counted 557 records a day. The author describes the rise as steep but says its rate of acceleration slowed: daily volume increased about 20% from June to July, 28% from July to August, 22% from August to September, and about 11% in October so far. A projection that October could end near 17,000 is the author’s estimate, not a recorded total.
The increase is concentrated among several large organizations, the review says. Microsoft’s records rose from 180 in October 2025 to 1,455 in October 2026; Oracle’s rose from 78 to 1,078, and GitHub’s from 276 to 1,159. These counts describe published CVE records, not necessarily unique software flaws found independently in each month. The analysis says 98% of October records had 2026 IDs and the median interval from reserving an ID to publication was 15 days, findings it uses to argue that the increase is not simply an old backlog being released at once.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
Why the Fixing Queue Matters
The central security concern in the review is not just how quickly flaws are identified, but whether maintainers can repair them. The source says Anthropic’s disclosure dashboard listed 6,157 vulnerabilities reported to maintainers and that, to the company’s knowledge, 516 had been patched. That is roughly one in twelve, based on the figures cited. These are Anthropic’s reported totals and patch-status knowledge; they do not establish that every unpatched issue is exploitable or that no other fixes have been made.
A growing disclosure count can mean more weaknesses are being found and documented, which gives vendors and users information they can act on. But records alone do not tell readers whether a flaw is present in systems they use, whether exploitation is occurring, or whether a fix is available and installed. The gap between disclosure and remediation matters because organizations can remain exposed while software maintainers assess reports, prepare updates and distribute them.
The review also cites attackers using low-cost AI agents against older vulnerabilities, attributing that point to reporting by NorForge and Reuters. That claim suggests AI’s security effect may extend beyond discovering new bugs: tools can also make it easier to work with already known weaknesses. The article does not provide enough detail in the supplied material to quantify how often those attacks occur or link them to the October CVE surge.
Popular right now
Roborock RockNeo Q110H Wire-Free Robot Lawn Mower
iRobot Roomba Max 715 Pet Robot Vacuum with AutoEmpty Dock
Dyson Car+Boat Cordless Handheld Vacuum
As an affiliate, we earn on qualifying purchases.
What CVE Counts Can Show
A CVE record is a public identifier and disclosure record for a vulnerability. The source describes the process as coordinated disclosure, with records generally published by a CVE Numbering Authority, often a vendor, after a fix or a disclosure deadline. That means CVE totals count published records, not attacks, and do not by themselves reveal who first discovered a flaw.
That distinction complicates claims that the increase is entirely the work of defenders or AI systems. The review found that only 6,346 of 13,934 records—46%—named a finder. It identified 200 records, or 1.4%, that explicitly credited an AI lab or AI security firm. The author calls this a floor because records may omit the finder or fail to describe AI assistance. The figures therefore cannot measure AI’s total contribution.
The review also cites Anthropic’s dashboard, which as of Oct. 2 listed 29,439 candidate vulnerabilities found by Claude models. It says external firms reviewed 6,123 candidates and confirmed 92.7% as real; 6,157 had been reported to maintainers. The same material says those findings had produced 219 CVE records and 365 GitHub advisories so far. OpenAI’s Patch the Planet program with Trail of Bits is described as having reported hundreds of security issues across 19 open-source projects, each reviewed by people. These are company-program figures, not an independent measure of all AI-assisted security research.
“The curve is still climbing fast, but the acceleration has slowed, not run away.”
— Thorsten Meyer, ThorstenMeyerAI.com
What the Records Leave Unknown
The available counts do not establish how much AI caused the rise in disclosures. More than half of the October records did not name a finder, and an explicit AI credit can miss cases where researchers used AI without recording it. The records also do not show whether a vulnerability was exploited before disclosure, how severe it is in practice, or how many affected systems remain exposed.
Patch status is also incomplete. The figure of 516 patched vulnerabilities is reported as Anthropic’s knowledge, not as a comprehensive audit of every maintainer or software release. The supplied source excerpt begins to compare additions to CISA’s Known Exploited Vulnerabilities catalog with the CVE increase but does not provide the full comparison or its current-year total. No firm conclusion about the relative pace of exploitation can be drawn from the information provided here.
There are limits to the date and count comparisons as well. The October 2026 period is partial, the full-month 2026 total is not yet available, and the source’s figures distinguish records published, later rejected, and records in its Oct. 1–25 table. The author’s estimate of a near-17,000 October finish remains a projection.
The Next Test Is Remediation
The immediate next milestone is the completed October record count, which can be compared with the author’s estimate once the month ends. Future updates to the NVD, CVE.org and CISA data may also clarify whether publication growth continues, levels off or changes as additional records are processed.
For software users and security teams, the practical next step is to track vendor advisories and install applicable fixes rather than treating a CVE total as a direct measure of exposure. The source’s figures also make patch-status reporting an important area to watch: more complete information from maintainers would help show how quickly reported problems are resolved.
Claims about AI-assisted discovery and AI-enabled exploitation will require evidence beyond disclosure counts. The data cited here supports a large rise in published records and a reported gap in known patching; it does not settle how much AI drove either trend or how the surge has affected real-world attacks.
Key Questions
How many CVE records were published in October 2026?
The review counted 13,934 records from Oct. 1 through 25. It separately reports 13,766 records published in October plus 202 later rejected. These figures have different stated scopes, and the final full-month total was not yet available when the data was retrieved on Oct. 26.
Does the increase prove AI is finding most vulnerabilities?
No. The review says only 1.4% of October records explicitly credited an AI lab or AI security firm, while 54% named no finder. Because records may not capture AI use, the count is not a full measure of AI’s role.
What does the patch gap figure mean?
Anthropic’s dashboard, as cited in the review, listed 6,157 vulnerabilities reported to maintainers and 516 patched to the company’s knowledge. The source does not present that figure as a complete independent audit of all fixes.
Does a higher CVE count mean more attacks are happening?
Not by itself. A CVE count measures published vulnerability records, not confirmed exploitation or attacks. The source excerpt cites reporting about attackers using AI agents against older flaws but does not provide enough figures to quantify that activity or connect it directly to the October record increase.
Source: ThorstenMeyerAI.com
