🔍 Read the full analysis: Are Bug Hunters Finding More CVEs In The Age Of AI? on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A source analysis of NVD and CVE.org records found 13,934 new CVEs published from Oct. 1–25, 2026, compared with 4,389 in all of October 2025. The records do not establish how many vulnerabilities AI helped find, while Anthropic says only 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge.
New CVE publications surged in October, with 13,934 records issued from Oct. 1–25, according to an analysis of National Vulnerability Database and CVE.org data published by ThorstenMeyerAI.com on Oct. 26. The increase is real, but the records do not show how much artificial intelligence contributed to finding the bugs, and the analysis points to a separate concern: whether maintainers can patch reported vulnerabilities quickly.
The article counted records by publication date using the NVD CVE API and cross-checked October IDs against CVE.org. It reports 13,934 records for Oct. 1–25, compared with 4,389 for all of October 2025. The author says the two data sources agree on 13,766 October records, with 202 more subsequently rejected; the supplied material does not fully explain how those figures reconcile with the 13,934 total for the first 25 days.
The increase is concentrated among a handful of organizations. Microsoft had 1,455 October records, compared with 180 in October 2025, while Oracle had 1,078, GitHub 1,159 and VulnCheck 2,085. The article says Oracle’s records were published almost entirely on one day. It also notes that the publication rate’s month-to-month growth slowed: daily volume rose 20% from June to July, 28% from July to August and 22% from August to September, then about 11% in October so far.
The records provide limited information about who discovered each issue. Of the October records examined, 6,346, or 46%, named a finder. The author found explicit credit to an AI lab or AI security firm in 200 records, or 1.4%. That figure is a minimum based on explicit attribution, not a measure of AI’s total role, since records often omit the finder or tool.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Bottleneck After Discovery
More published vulnerabilities can give software vendors and users a clearer view of defects that need attention. But a larger CVE count does not, by itself, show that software has become less secure, that attackers are exploiting more bugs, or that AI caused the increase. The total can rise when organizations uncover and disclose existing flaws, or when vendors and numbering authorities publish records in larger batches.
The patch figures in the source highlight the gap between finding and fixing. Anthropic’s dashboard, as reported in the article, listed 6,157 vulnerabilities reported to maintainers; Anthropic said 516 were patched to its knowledge. That leaves many reported issues without a recorded fix in the company’s tracking. Users may remain exposed while maintainers assess reports, develop patches and distribute updates. The figures are specific to Anthropic’s reported work and should not be treated as a measure of patching across the software industry.
The article also says attackers are using low-cost AI agents against older vulnerabilities, citing NorForge and Reuters. That claim points to a concern distinct from the CVE surge: AI might help defenders find flaws, but it may also make it easier to search for ways to exploit known ones. The supplied material does not quantify how often that is happening.
Products Worth Considering
Dell UltraSharp 32 U3226QER 4K Thunderbolt Hub Monitor
Dell UltraSharp U2725QE 27-Inch 4K UHD IPS Black Monitor
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER)
As an affiliate, we earn on qualifying purchases.
What the CVE Counts Measure
A CVE record identifies a publicly disclosed vulnerability. The source article explains that records are generally issued through coordinated disclosure by a CVE Numbering Authority, often a vendor, after a fix or a disclosure deadline. A published CVE is not a direct count of active attacks, nor does it necessarily identify who first found the flaw.
For October, the analysis says 98% of records carried a 2026 ID and the median time between reserving an ID and publication was 15 days. The author uses those details to argue that the jump is not mainly a backlog of older records being released at once. The article’s table also records rising monthly totals: 8,001 in June, 9,919 in July, 12,719 in August and 15,074 in September 2026. The October figure covers only the first 25 days, so it is not directly comparable with complete months.
AI-specific disclosures offer another partial view. Anthropic reported 29,439 candidate vulnerabilities identified by Claude models as of Oct. 2; external firms reviewed 6,123 and confirmed 92.7% as real, according to the company figures cited by the article. The company said 6,157 findings had been reported to maintainers. Those findings had produced 219 CVE records and 365 GitHub advisories at the time cited. OpenAI’s Patch the Planet program with Trail of Bits reported hundreds of security issues across 19 open-source projects, each reviewed by people, the article says.
“The curve is still climbing fast, but the acceleration has slowed, not run away.”
— Thorsten Meyer, ThorstenMeyerAI.com
What the Public Records Miss
The largest uncertainty is how much AI contributed to the overall rise. Only 1.4% of the examined records explicitly credited an AI lab or security firm, but 54% named no finder. The low attribution rate cannot establish that AI played a small role; equally, company-reported candidate findings cannot show that AI caused the broader increase in published CVEs.
The source says the Known Exploited Vulnerabilities catalog grew more slowly than CVE publications, but the provided material ends before giving the full comparison or the catalog’s 2026 total. It therefore does not support a complete numerical account of confirmed exploitation. The article’s projection that October could finish near 17,000 records is an estimate based on the pace through Oct. 25, not a final count.
It is also not clear from the supplied material how many of Anthropic’s reported vulnerabilities remain unfixed today, whether maintainers have patched issues that the company has not recorded, or how patch status varies by severity and software use. The data does not establish how many of the published flaws are exploitable in real-world conditions.
Final October Counts and Patch Status
The October total will become clearer after the month ends and databases update. A final count can test Meyer’s estimate of roughly 17,000 records, but it will not by itself identify who found the vulnerabilities or whether AI played a part. Better attribution in CVE records and consistent reporting from research programs would help answer that question.
For users and organizations, the immediate practical focus remains checking vendor advisories and applying relevant security updates. Maintainers and researchers may publish further information about fixes for reported flaws. Anthropic’s patch figure is based on what the company knew when its dashboard was consulted; an updated status could change the picture for those reports.
Further evidence about known exploitation would also help distinguish a rise in disclosure from a rise in attacks. The source cites CISA’s Known Exploited Vulnerabilities catalog as a public indicator, but the information provided here does not include a complete 2026 comparison. Until those figures and more complete patch data are available, the scale of AI’s contribution—and the real-world effect of the CVE increase—remains unsettled.
Key Questions
How many CVEs were published in October 2026?
The analysis reports 13,934 records from Oct. 1–25. It also gives 13,766 October records plus 202 later rejected, figures whose relationship to the 13,934 total is not fully explained in the supplied material.
Does the CVE surge prove AI is finding more bugs?
No. The records show a rise in publications, but many do not name a finder. The analysis found explicit credit to an AI lab or security firm in 1.4% of the records examined, which it describes as a floor rather than a complete measure of AI’s role.
Which organizations had the most records in the analysis?
The source lists Microsoft with 1,455 October records, Oracle with 1,078, GitHub with 1,159 and VulnCheck with 2,085. The counts reflect records associated with those organizations, not necessarily vulnerabilities independently discovered by each one.
How many of Anthropic’s reported vulnerabilities were patched?
Anthropic said 516 of 6,157 vulnerabilities reported to maintainers were patched to its knowledge. The figure reflects the company’s tracking and may not capture every fix.
Does a higher CVE count mean more attacks?
Not by itself. CVE records document disclosed vulnerabilities; they do not show how many are being exploited. The source says CISA’s Known Exploited Vulnerabilities catalog grew less sharply than CVE publications, but the supplied material does not provide a complete 2026 comparison.
Source: ThorstenMeyerAI.com
