🔍 Read the full analysis: Taking Stock Of CVEs, AI, Bug Hunters, And The Patch Gap on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
An analysis published Oct. 26 counts 13,934 CVE records published from Oct. 1 to 25, 2026, more than three times the total for October 2025. The records do not show how much AI contributed to discovery, and Anthropic says only 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge. The scale of exploitation and the reasons for the patch gap remain unclear.
A review of public vulnerability records found 13,934 CVE records published from Oct. 1 to 25, 2026, while Anthropic says maintainers have patched 516 of 6,157 vulnerabilities it reported to them. The figures show an increase in disclosure activity, but they do not establish how much AI contributed to the rise or how many reported flaws are being exploited.
The analysis by Thorsten Meyer, published Oct. 26, queried the U.S. National Vulnerability Database (NVD) for records by publication date and cross-checked October entries against CVE.org. It counted 13,934 records for Oct. 1–25, compared with 4,389 records across all of October 2025. The NVD data included all statuses; the analysis says 13,766 October records were new, with another 202 later rejected. Those figures reflect different status groupings, not a single interchangeable total.
The daily publication rate rose from 267 in June to 320 in July, 410 in August and 502 in September, according to the analysis. For Oct. 1–25 it was 557 per day. Meyer describes the pace as still climbing but says its acceleration slowed: the reported monthly growth in daily rate fell to about 11% in October, from 22% between August and September. His estimate that October could end near 17,000 records is a projection, not a final count.
The increase is concentrated among a handful of organizations. The analysis counts Microsoft records rising from 180 in October 2025 to 1,455 in October 2026, Oracle from 78 to 1,078, GitHub from 276 to 1,159 and VulnCheck from 163 to 2,085. It says 98% of October records carried 2026 CVE identifiers and the median time from reserving an identifier to publication was 15 days. These are counts of published records, not a direct measure of newly discovered flaws, severity or exploitation.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Repair Queue Behind the Counts
A CVE total measures disclosure activity; it does not show whether users are protected. A vulnerability can be identified and assigned a record before a fix is available, and publication does not show whether organizations have installed a patch. The reported patch gap is a separate measure: more discoveries can increase the number of issues requiring review by maintainers, vendors and security teams.
Anthropic’s disclosure dashboard, as reported by Meyer and dated Oct. 2, lists 6,157 vulnerabilities reported to maintainers and 516 patched to the company’s knowledge—about one in twelve. That is a company-reported figure, not an independently verified measure of all fixes. It indicates that, in this set of reports, the number known to Anthropic as patched was substantially lower than the number reported.
The analysis also refers to reporting by NorForge and Reuters on attackers using low-cost AI agents against older bugs. That material suggests AI may affect both discovery and exploitation, but the supplied figures do not establish how widespread such activity is. The analysis does not provide figures showing how many disclosed flaws are being exploited or how quickly fixes reach affected systems.
Products Worth Considering
Bose QuietComfort Ultra Earbuds (2nd Gen), Deep Plum
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
What CVE Records Can Show
A CVE is a publicly assigned identifier for a disclosed vulnerability. Records are generally published through the CVE program by a CVE Numbering Authority, often a vendor, as part of coordinated disclosure. The analysis argues that this makes the publication surge a measure of defender-side reporting: attackers do not normally file CVEs, even though a record may describe a flaw that was first found through malicious activity.
That does not mean a CVE identifies who originally discovered the bug. Meyer’s review of 13,934 October records found that 6,346, or 46%, named a finder. Only 200 records, or 1.4%, explicitly credited an AI lab or AI security firm as a finder, reporter or tool: 123 mentioned Anthropic or Claude, 65 named firms including AISLE, XBOW or depthfirst, and 16 credited OpenAI. The article calls that a floor, since missing attribution does not prove AI was uninvolved.
The lab figures also use different measures from CVE counts. Anthropic reports 29,439 candidate vulnerabilities found by Claude models; external firms reviewed 6,123 and confirmed 92.7% as real. The company says those findings had produced 219 CVE records and 365 GitHub advisories at the time reported. OpenAI’s Patch the Planet program with Trail of Bits says it found hundreds of security issues across 19 open-source projects, with each reviewed by people. These are company-reported program results, not a count that can be directly compared with monthly CVE totals.
“6,157 have been reported to maintainers.”
— Anthropic, as reported in its disclosure dashboard
What the Records Leave Unknown
The record counts cannot establish how many bugs were found with AI, how many are exploitable in practice or how many are currently under active attack. More than half of the October entries name no finder, and an absent attribution does not reveal the method used to find a flaw. Conversely, the 1.4% explicitly credited to AI labs or security firms should not be treated as AI’s full contribution.
The patch figure also has limits: Anthropic says 516 of its 6,157 reported vulnerabilities are patched to its knowledge, but the supplied material does not give an independent audit, a breakdown of fix timelines, or the status of every report. The source excerpt says the CISA Known Exploited Vulnerabilities catalog grew far less than the CVE count, but it ends before giving the full comparison period or figures for 2026. The scope of current exploitation and the reasons individual fixes remain outstanding are therefore not established here.
Track Fixes and Exploitation
Relevant follow-up measures include final October publication totals, updates to vendor and maintainer advisories, and changes in CISA’s Known Exploited Vulnerabilities catalog. These measures can provide additional information about disclosure and confirmed exploitation, but none alone captures every attack or unpatched system.
Maintainers and affected software users will also need to follow each vulnerability’s advisory for a confirmed fix and remediation guidance. Until more complete patch-status and exploitation data are available, the October CVE count should be read as a measure of disclosure activity, not as a count of active threats or repaired software.
Key Questions
How many CVE records were published in October 2026?
The analysis counted 13,934 records from Oct. 1 to 25. It separately reports 13,766 new records in the NVD data plus 202 later rejected; the totals differ because the status categories differ.
Does the increase prove AI is finding most vulnerabilities?
No. Only 200 of the October records explicitly credited an AI lab or AI security firm, while 54% named no finder. The records cannot show the full role of AI, and the explicitly credited share is not a complete measure.
What does the Anthropic patch figure mean?
Anthropic reported 6,157 vulnerabilities to maintainers and said 516 were patched to its knowledge as of the figures cited in the analysis. It is a company-reported status, not an independently audited count of every affected system.
Does a published CVE mean a vulnerability is being exploited?
No. A CVE is a disclosure record; it does not by itself establish active exploitation, severity in a particular environment or whether a system has been patched.
Source: ThorstenMeyerAI.com
