🔍 Read the full analysis: Mapping The CVE Surge: AI, Researchers, And Remediation on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A review of NVD and CVE.org records found 13,934 new CVE records published from Oct. 1–25, 2026, with large vendors and numbering organizations accounting for much of the rise. The available records do not establish how many vulnerabilities AI found, and Anthropic says only 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge.
A review of public vulnerability records found 13,934 new CVEs published from Oct. 1–25, 2026, more than three times the total for all of October 2025. The analysis, published Oct. 26 by ThorstenMeyerAI.com, says the increase is concentrated among a small number of vendors and disclosure organizations, while available records cannot establish how much artificial intelligence contributed to finding the bugs. Its figures also point to a separate concern: many reported vulnerabilities have not yet been patched.
The analysis counted records by publication date using the National Vulnerability Database’s CVE API and cross-checked October records against CVE.org. It reports 13,934 records for Oct. 1–25, compared with 4,389 across October 2025. The account separately says the October total included 13,766 records and 202 later rejected; those figures sum to 13,968, not 13,934, a discrepancy the article does not explain. Its headline count should therefore be read alongside that inconsistency.
The reported 2026 total stood at 88,772 CVEs, which the analysis describes as 78% above the full-year 2025 total. October’s publication pace was 557 records a day through Oct. 25, compared with 142 a day in October 2025. The author says daily volume rose by 20% to 28% month over month from June through September, then by about 11% in October. A projected October finish near 17,000 is an estimate, not a recorded total.
The rise is uneven across organizations. The source reports 1,455 Microsoft records in October, up from 180 in October 2025, and 1,078 for Oracle, up from 78. GitHub and VulnCheck also recorded large increases. By comparison, Linux kernel records rose from 660 to 925. The analysis says 98% of October records carried a 2026 identifier and gives a median of 15 days between reserving an ID and publication, which it uses to argue that the surge is not simply older records being released late.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Patch Gap After Discovery
A larger disclosure count does not by itself show that attackers have more working exploits or that software has become less secure. CVE records document vulnerability disclosures, and the analysis says the record count alone cannot tell who first found each flaw, whether it is exploitable in a particular system, or how many users remain exposed. The practical risk depends in part on whether maintainers can produce and distribute fixes and whether organizations install them.
Anthropic’s dashboard, as described in the source, lists 6,157 vulnerabilities reported to maintainers and 516 patched to the company’s knowledge. That is about one in twelve, but it is the company’s reported figure and may not capture every fix. The gap matters because discovery can create work for maintainers and security teams faster than they can validate, prioritize and deploy updates. For readers and organizations, the count is a signal to track—not a measure of the number of systems currently at risk.
The source also cites reporting by NorForge and Reuters that attackers are using low-cost AI agents against older vulnerabilities. That claim underscores why patching existing software matters, but the supplied material gives no incident totals or independent measurement linking the reported CVE surge to a rise in attacks. The evidence presented supports attention to remediation, not a conclusion that AI has caused a matching increase in exploitation.
Products Worth Considering
FLEXISPOT 42-Inch Electric Height-Adjustable Desk Converter with Keyboard Tray
Apple iPad Air 13-inch (M4), 128GB, Wi-Fi 7, Space Gray
Dell XPS 13 9350 AI Professional Laptop 13.4 120Hz FHD+ Display
As an affiliate, we earn on qualifying purchases.
What the CVE Records Show
A CVE is a public identifier used to track a disclosed vulnerability. The source explains that records are typically published through a CVE Numbering Authority, often after a vendor or maintainer has coordinated a disclosure. That means publication counts reflect the disclosure process as well as underlying software flaws; a rise can result from changes in reporting volume or the work of a few organizations, not necessarily a sudden change in the rate at which flaws are created.
In its review of 13,934 October records, the author says 6,346 records named a finder, while 54% did not. The analysis counted 200 records, or 1.4%, that explicitly credited an AI lab, AI model or AI security company. It characterizes that figure as a floor because records may omit tools or researchers involved. These fields therefore cannot reliably measure AI’s overall role in vulnerability discovery.
The source describes Anthropic’s dashboard as listing 29,439 candidate vulnerabilities identified by Claude models. It says external firms reviewed 6,123 and confirmed 92.7% as real; the company had reported 6,157 to maintainers. These are Anthropic’s figures, not a count independently established by the CVE database. The source also reports that OpenAI’s Patch the Planet program with Trail of Bits found “hundreds of security issues” across 19 open-source projects, with each reviewed by a person. Taken together, the examples show activity by AI-related programs but do not quantify their share of all new disclosures.
The public records do not establish how many October vulnerabilities were discovered with AI assistance. More than half name no finder, and the 1.4% explicitly credited to AI-related organizations or tools is not a complete measure. The supplied material also does not provide enough detail to reconcile its October record totals: 13,934 overall versus 13,766 plus 202 later rejected.
It remains unclear how many reported vulnerabilities are exploitable in real-world deployments, how quickly unpatched items are being addressed beyond Anthropic’s stated knowledge, and whether attacks against old flaws have increased. The source says CISA’s Known Exploited Vulnerabilities catalog added 245 entries in 2025, but the excerpt ends before giving a comparable 2026 figure. Its claim that AI agents are being used against older bugs is attributed to NorForge and Reuters; no quantified trend or case details are supplied here.
The source also says Anthropic reported that a Chinese open-weight model can build exploits end to end with weak safeguards. That is an attributed company claim in the material, not an independently established assessment presented with testing details. The extent of the model’s capabilities and the effect of safeguards remain unverified here.
Tracking Fixes and Exploitation
The October count is incomplete because the analysis covers publication through Oct. 25. A final monthly total can be compared with the source’s estimate of about 17,000, while keeping in mind that the estimate is not an observed result. Further checks of CVE.org, NVD and vendor disclosures may also clarify the discrepancy between the reported totals.
For a clearer picture of security impact, the next useful indicators are the number of disclosed vulnerabilities that receive fixes, the time between disclosure and patch availability, and additions to CISA’s Known Exploited Vulnerabilities catalog. Those measures address different questions: disclosure volume shows how many records were published, patch data tracks remediation, and the CISA catalog identifies vulnerabilities known to be exploited in the wild. The available material does not provide a complete October comparison across all three.
Maintainers, vendors and organizations will need to continue prioritizing fixes and confirming whether updates have reached affected systems. Until more complete data are available, the reported surge is evidence of increased disclosure activity—not proof of an equivalent rise in successful attacks or of a measured, market-wide effect from AI-assisted discovery.
Key Questions
How many CVE records were reported for October 2026?
The source analysis reports 13,934 records published from Oct. 1–25. It also gives separate figures of 13,766 records and 202 later rejected, which do not add up to that headline count; the discrepancy is not explained.
Does the CVE increase prove AI is finding most vulnerabilities?
No. The analysis says 54% of October records name no finder, and 1.4% explicitly credit an AI lab, model or AI security firm. Those fields are incomplete and do not establish AI’s total contribution.
What does the source say about patching?
According to figures attributed to Anthropic, 516 of 6,157 vulnerabilities reported to maintainers were patched to the company’s knowledge. The source does not establish that this captures every patch.
Does a CVE record mean attackers are exploiting the vulnerability?
No. A CVE record documents a disclosed vulnerability; it does not by itself show that the flaw is exploitable in a particular system or being used in attacks. The source does not provide a complete 2026 exploitation comparison.
Source: ThorstenMeyerAI.com
