🔍 Read the full analysis: What’s Fueling The CVE Boom? AI, Bug Hunters, And Patch Data on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
The source reports 13,934 CVE records published from Oct. 1–25, 2026, compared with 4,389 in all of October 2025. The increase is concentrated among a few vendors and record publishers; available data does not establish how much AI contributed. Anthropic says 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge, highlighting the gap between finding and fixing flaws.
Security vulnerability disclosures have climbed sharply in 2026, with 13,934 CVE records published from Oct. 1–25, more than three times the 4,389 records in all of October 2025, according to an analysis of NVD and CVE.org data published Oct. 26. The increase reflects a concentrated jump in records from major vendors and vulnerability publishers, but the data does not show how much artificial intelligence contributed to finding the flaws—or how quickly affected software is being fixed.
The report counted CVE records by publication date using the National Vulnerability Database API and cross-checked October entries against CVE.org. Its figures show 88,772 records so far in 2026, 78% more than the full-year 2025 total. The October count includes 13,766 records and 202 later-rejected entries, according to the report; the author’s headline comparison uses the full 13,934 records published during the first 25 days.
The author says the rate of increase has eased: daily volume rose 20% from June to July, 28% from July to August and 22% from August to September, then about 11% in October so far. The report estimates that October could end near 17,000 records if the current pace holds. That is a projection, not a final count. It also says 98% of October records carry a 2026 identifier, while the median interval between reserving an identifier and publication was 15 days.
The increase is uneven across organizations. Microsoft had 1,455 October records, compared with 180 a year earlier; Oracle had 1,078, compared with 78; GitHub had 1,159, compared with 276; and VulnCheck had 2,085, compared with 163. The Linux kernel rose from 660 to 925. The analysis says that a small number of vendors and clearinghouses account for much of the rise, rather than every software category increasing at the same rate.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Patch Queue Is the Key Measure
A higher CVE count means more vulnerabilities are being publicly documented; it does not, on its own, show that attackers are exploiting more flaws or that software has become less secure. The report describes CVEs as part of coordinated disclosure: records are generally published by a CVE Numbering Authority, often a vendor, after a fix or a disclosure deadline. Criminals do not file CVEs, though a record can document a flaw that was previously exploited.
The more immediate concern in the source material is whether fixes reach users. Anthropic’s dashboard, as reported in the article, lists 6,157 vulnerabilities reported to maintainers and says 516 had been patched to the company’s knowledge—about one in twelve. That figure is limited to Anthropic’s reported findings and its knowledge of their status; it is not a measure of all vulnerabilities or all software patches.
For organizations responsible for software, a growing disclosure stream can increase the work of triage, testing and deployment. The practical risk depends on details the raw CVE total cannot capture: which products are affected, whether systems are exposed, whether exploits are available, and how promptly reliable fixes are applied. The report also points to Reuters coverage of attackers using inexpensive AI agents against older vulnerabilities, but that does not establish that the new CVE surge itself has caused an increase in exploitation.
Popular right now
Ninja Flip Toaster Oven and Air Fryer, 8-in-1, Stainless Steel, SP151
Ninja Luxe Café Premier 3-in-1 Espresso Machine, Drip Coffee & Cold Brew
Roborock Robot Vacuum and Mop with LiDAR Navigation and 10,000 Pa Suction
As an affiliate, we earn on qualifying purchases.
What the CVE Counts Can Show
The report’s comparison uses records published in each period, not a count of vulnerabilities newly discovered during that period. A CVE is an identifier and disclosure record; the date it is published is not necessarily the date a flaw was found, and one vendor or numbering authority may publish many records at once. The article says Oracle’s October records were concentrated largely on Oct. 20 and links Microsoft’s increase to its October Patch Tuesday.
Attribution is incomplete. Of the 13,934 October records, the report found that 6,346, or 46%, named a finder. It counted 200 records, or 1.4%, that explicitly credited an AI lab or AI security company as a finder, reporter or tool: 123 mentioning Anthropic or Claude, 65 naming companies including AISLE, XBOW or depthfirst, and 16 mentioning OpenAI. The author calls this a floor, because records that do not name a finder cannot reliably show whether AI was involved.
Separate company disclosures offer additional, but not directly comparable, measures. Anthropic says its models identified 29,439 candidate vulnerabilities; external firms reviewed 6,123 and confirmed 92.7% as real. The company says those findings have resulted in 219 CVE records and 365 GitHub advisories so far. OpenAI’s Patch the Planet program with Trail of Bits reports “hundreds of security issues” across 19 open-source projects, with each reviewed by people. These are company-reported program figures, not a complete accounting of AI’s contribution to the overall CVE increase.
“The curve is still climbing fast, but the acceleration has slowed, not run away.”
— Thorsten Meyer, the report’s author
AI Attribution Remains Incomplete
The available record data cannot establish what share of the 2026 rise came from AI-assisted discovery. More than half of October records named no finder, and the 1.4% figure captures only records that explicitly credit an AI lab, security firm or tool. The source also does not independently audit the companies’ reported discovery totals or explain whether their methods and counting rules align.
The patch figure has limits too: Anthropic says 516 of its 6,157 reports were patched to its knowledge, but the material does not give a common status date for every report or a comparable patch rate across other organizations. The supplied source cuts off while describing the growth of CISA’s Known Exploited Vulnerabilities catalog, so it does not provide enough figures to compare exploitation trends with the CVE rise. It remains unclear how the full October count will compare with the projection, and whether the surge will continue at the same pace.
Track Final Counts and Fixes
The October total will become clearer after the month closes and records are reconciled, including entries later rejected or revised. Further analysis of finder attribution, vendor contributions and publication timing could help explain whether the rise reflects more discovery, broader reporting practices, or a mix of both.
For security teams, the next useful signal is not the headline count alone but the status of relevant flaws: whether affected products are in use, whether exploitation is confirmed, and whether maintainers have issued and users applied fixes. More complete patch-status reporting and comparable data on known exploitation would help show whether the enlarged disclosure stream is translating into greater risk.
Key Questions
How many CVE records were published in October so far?
The report counted 13,934 records from Oct. 1–25, 2026. It says 13,766 were records and 202 were later rejected; its total comparison uses all 13,934 published entries.
Does the surge prove AI is finding most vulnerabilities?
No. The report found that 1.4% of October records explicitly credited an AI lab or security firm, but 54% named no finder. The available data cannot determine AI’s full contribution.
Are the new CVEs evidence of more attacks?
Not by themselves. CVE records document vulnerabilities, while exploitation requires separate evidence. The source material does not provide enough CISA figures to quantify how exploitation changed alongside the CVE count.
How many Anthropic-reported vulnerabilities were patched?
Anthropic said 516 of 6,157 vulnerabilities reported to maintainers had been patched to its knowledge. That is the company’s reported status, not a patch rate for all vulnerabilities.
Source: ThorstenMeyerAI.com
