🔍 Read the full analysis: CVEs Are Going To The Moon: What The Data Shows About AI, Bug Hunters And The Patch Gap on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The source analysis counted 13,934 CVE records published from Oct. 1–25, 2026, more than three times the total for all of October 2025. The increase is concentrated among major vendors and vulnerability coordinators; the records do not establish how much AI contributed to finding bugs. The source also says only 516 of 6,157 vulnerabilities Anthropic reported to maintainers were known to be patched.
A review of public vulnerability records found 13,934 CVEs published from Oct. 1–25, 2026, more than three times the 4,389 recorded in all of October 2025, but the records do not show how much artificial intelligence contributed to finding the flaws. The analysis, published by Thorsten Meyer on Oct. 26, also points to a separate concern: vulnerabilities can be disclosed faster than software maintainers patch them.
Meyer said he queried the National Vulnerability Database’s CVE API for records by publication date and cross-checked October entries against CVE.org. The two sources agreed on 13,766 October records, plus 202 records later rejected. The analysis’s 13,934 figure covers the first 25 days of the month; the difference in totals reflects the article’s stated period and record-status details, which are not fully reconciled in the source.
The publication rate climbed from 8,001 records in June to 9,919 in July, 12,719 in August and 15,074 in September, according to the analysis. Meyer calculated month-to-month growth in the daily rate at 20% from June to July, 28% to August and 22% to September, then about 11% in October so far. He estimated that October could finish near 17,000 records if the pace holds; that is a projection, not a final count.
The increase was uneven across publishers. The analysis counted 1,455 Microsoft records in October, compared with 180 in October 2025, and 1,078 for Oracle, compared with 78. GitHub rose from 276 to 1,159, while VulnCheck increased from 163 to 2,085. The Linux kernel’s count rose from 660 to 925. Meyer attributes much of the overall curve to a small number of large vendors and vulnerability coordinators.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
A Faster Discovery-to-Fix Pipeline
The surge matters because disclosure is only one step in reducing risk. A public CVE can help organizations identify affected products and prioritize fixes, but it does not show whether a patch is available, installed or whether attackers are exploiting the flaw.
Meyer cited Anthropic’s dashboard, which said the company had reported 6,157 vulnerabilities to maintainers; 516 were patched to Anthropic’s knowledge. That count suggests a gap between reporting and remediation, but it is specific to the vulnerabilities in Anthropic’s reporting and is not a measure of patching across the software industry.
The article also points to concerns that attackers can use inexpensive AI agents to work with older vulnerabilities, citing reporting by NorForge and Reuters. If that account is accurate, the practical risk depends not only on how quickly new flaws are found, but on how quickly affected software is fixed and deployed. The source does not provide enough detail to quantify the scale of AI-enabled exploitation.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
Logitech MX Vertical Wireless Ergonomic Mouse – Graphite
As an affiliate, we earn on qualifying purchases.
What the CVE Counts Capture
A CVE record documents a publicly identified vulnerability, generally through a coordinated disclosure process involving a vendor or other CVE Numbering Authority. The record is not a direct count of all bugs discovered, and it does not identify every person or tool involved in finding one. A vulnerability first noticed during an attack may still receive a CVE when defenders coordinate its disclosure.
In the October records reviewed by Meyer, 6,346 of 13,934 entries named a finder. The other 54% did not. The analysis counted 200 records, or 1.4%, that explicitly credited an AI lab or AI security company as a finder, reporter or tool: 123 mentioning Anthropic or Claude, 65 crediting firms including AISLE, XBOW or depthfirst, and 16 mentioning OpenAI. These are explicit attributions in the records, not a complete measure of AI’s contribution.
The article also cites Anthropic’s reported research figures: its dashboard listed 29,439 candidate vulnerabilities found by Claude models, of which external firms reviewed 6,123 and confirmed 92.7% as real. The company said 6,157 findings had been reported to maintainers. Those figures come from the company, and the source says the findings had generated 219 CVE records and 365 GitHub advisories. OpenAI’s Patch the Planet program with Trail of Bits reported “hundreds of security issues” across 19 open-source projects, with each reviewed by people.
“That is a floor, not an estimate.”
— Thorsten Meyer, describing the CVE attribution data
Attribution and Patch Rates Remain Partial
The CVE records cannot establish how many vulnerabilities were found with AI assistance. More than half of the October records reviewed named no finder, and explicit AI credit may not capture tools used behind the scenes. The source’s attribution counts should not be read as an estimate of AI’s overall share.
The source also does not provide a complete, independently verified account of patch status across all reported vulnerabilities. Anthropic’s 516 patched figure is what the company said it knew about, not a universal patch rate. Nor does the supplied material give a full comparison of confirmed exploitation with the CVE increase: it says CISA’s Known Exploited Vulnerabilities catalog grew less sharply, but the source text ends before giving the relevant 2026 figures.
There is also a difference between the article’s 13,934 count for Oct. 1–25 and its cross-check tally of 13,766 October records plus 202 later-rejected entries. The source does not fully explain how those totals relate, so they should be treated as distinct reported figures rather than combined.
Watch for Final Counts and Fixes
The October total remains provisional. Meyer’s estimate of about 17,000 records for the full month depends on the pace continuing and should be checked against final publication data. Later updates to CVE.org and the NVD may also change counts as records are added, revised or rejected.
For readers and software operators, the next useful indicators are not just new CVEs but patch availability, patch deployment and confirmed exploitation. The supplied analysis does not establish how quickly those measures are changing across the ecosystem. More complete attribution from researchers and labs could also clarify the role of AI, although public records may not capture every tool used in discovery.
Key Questions
How many CVE records were reported for October 2026?
The analysis counted 13,934 records published from Oct. 1–25. It separately reported that the NVD and CVE.org cross-check found 13,766 October records, plus 202 later rejected; the source does not fully reconcile the totals.
Does the increase prove that AI is finding most vulnerabilities?
No. The reviewed records explicitly credited an AI lab or AI security firm in 200 cases, or 1.4%, but 54% named no finder. Those records cannot establish AI’s full contribution, including when its use was not disclosed.
Which organizations accounted for much of the rise?
The analysis reported large October increases for Microsoft, Oracle, GitHub and VulnCheck compared with October 2025. It said the Linux kernel’s increase was smaller, indicating that publication growth was concentrated rather than uniform.
Are the reported vulnerabilities being patched?
The source says Anthropic reported 6,157 vulnerabilities to maintainers and knew of 516 patches. That is a company-reported figure for its findings, not an industry-wide patch rate.
What should be watched next?
Final October CVE counts, updates to the records and evidence about patching and exploitation will help show whether the publication surge is translating into reduced risk. The source does not yet provide complete figures for those measures.
Source: ThorstenMeyerAI.com
