🔍 Read the full analysis: Bug Hunters, AI, And CVEs: Understanding The Patch Gap on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A review of NVD and CVE.org records found 13,934 CVEs published from Oct. 1 to 25, 2026, more than three times the total for all of October 2025. The increase is concentrated among major vendors and does not show how many bugs AI found; the analysis says only 516 of 6,157 vulnerabilities Anthropic reported were patched to its knowledge.
A review of U.S. National Vulnerability Database and CVE.org records found 13,934 new CVE records published from Oct. 1 through Oct. 25, 2026—more than three times the 4,389 records in all of October 2025. The analysis, published Oct. 26 by ThorstenMeyerAI.com, says the surge is concentrated among a handful of large vendors and that the public data cannot establish how much artificial intelligence contributed to finding the bugs; it points to patching delays as a pressing risk.
The analysis counted records by publication date in the NVD’s CVE API and cross-checked October entries against CVE.org. It says the two sources recorded 13,766 published records for October at the time of the check, plus 202 records later rejected, while its Oct. 1–25 total is 13,934. The source reports 88,772 CVEs published so far in 2026, a figure it compares with 2025’s full-year total of 49,000. These are publication counts, not a count of newly discovered flaws or confirmed attacks.
The monthly pace rose from 8,001 records in June to 9,919 in July, 12,719 in August and 15,074 in September. For Oct. 1–25, the analysis gives 557 records per day and says the daily growth rate slowed to about 11% in October, after monthly increases of 20% to 28% from June through September. Its estimate that October could finish near 17,000 is a projection, not a final count.
Several organizations account for a large share of the increase. Microsoft’s October count rose to 1,455 records from 180 in October 2025, while Oracle rose to 1,078 from 78. GitHub’s count increased to 1,159 from 276, and VulnCheck’s to 2,085 from 163. The analysis says Oracle’s records were concentrated on Oct. 20. It cites SecurityWeek for the report that Microsoft’s October Patch Tuesday fixed 1,413 CVEs.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
Why the Patch Queue Matters
A higher CVE count means more publicly recorded vulnerabilities, but it does not by itself show that attackers are exploiting more flaws or that the software ecosystem is becoming less secure at the same rate. A CVE is a disclosure record, generally issued through a numbering authority as part of a coordinated process; criminals do not file CVEs. The figures therefore capture public reporting activity, not the full picture of who first found each flaw or whether it is being used in an attack.
The analysis identifies a gap between reporting and remediation. Anthropic’s disclosure dashboard, as described in the source, listed 6,157 vulnerabilities reported to maintainers and 516 patched to Anthropic’s knowledge—about one in twelve. If fixes are not developed, distributed and installed, discovery alone does not remove exposure. Organizations still need to determine which affected products they use, prioritize vulnerabilities and apply available updates.
The source also says attackers are using inexpensive AI agents against older vulnerabilities, citing NorForge and Reuters. That claim underlines a practical concern: security teams must handle both newly disclosed flaws and known bugs that remain unpatched. The provided material does not give detailed evidence about the tools’ use or measure how much exploitation they have enabled.
Popular right now
KitchenAid Artisan 5-Qt Tilt-Head Stand Mixer, Cardamom
iRobot Roomba 105 Vac Robot Vacuum
Ninja Foodi Air Fryer 10 Qt DualZone 6-in-1 Black DZ302
As an affiliate, we earn on qualifying purchases.
What CVE Counts Can Show
The author describes the October increase as a burst of vulnerability reporting, not necessarily a sudden wave of bugs created in October. The analysis says 98% of October records carry a 2026 CVE identifier and gives a median of 15 days between an identifier being reserved and a record being published. It interprets those figures as evidence against a large backlog dump, although publication timing alone does not establish when a bug was first discovered.
The records also offer limited information about finders. Of the 13,934 October records in the analysis, 6,346, or 46%, name a finder. The remaining records do not provide enough attribution to identify who discovered the flaw. The source counts 200 records, or 1.4%, that explicitly credit an AI lab or AI security firm: 123 credit Anthropic or Claude, 65 name firms including AISLE, XBOW or depthfirst, and 16 credit OpenAI. The author calls this a floor because records may omit or incompletely describe AI involvement.
Separate program figures provide additional but non-equivalent measures. Anthropic’s dashboard, as of Oct. 2, listed 29,439 candidate vulnerabilities found by Claude models; the source says external firms reviewed 6,123 and confirmed 92.7% as real. Those findings had resulted in 219 CVE records and 365 GitHub advisories at the time cited. OpenAI’s Patch the Planet program with Trail of Bits reported “hundreds of security issues” across 19 open-source projects, each reviewed by hand. These program totals cannot be directly equated with monthly CVE counts.
What the Records Leave Unknown
The data does not establish how many vulnerabilities were found with AI assistance, how much AI changed the rate of discovery, or how many published CVEs are exploitable in real-world conditions. Finder information is absent from more than half of the October records, and an explicit AI credit is not a complete measure of AI involvement. The source also says the figures do not support a conclusion that findings came almost entirely from U.S. researchers or allies.
The supplied material says CISA’s Known Exploited Vulnerabilities catalog grew, but it does not include the comparison figures needed to quantify that growth against the CVE surge: it only states that the catalog added 245 entries during 2025. Nor does it provide a complete account of patch status across vendors. Anthropic’s figure of 516 patched vulnerabilities is qualified as “to its knowledge,” and the material does not state how many of the remaining reports are still under review, have fixes in progress, or are not applicable to affected deployments.
Finally, the end-of-month CVE count remains unsettled in the source. The 13,934 figure covers Oct. 1–25, while another stated October tally is 13,766 published records plus 202 rejected records. The article does not fully reconcile those totals, so they should not be treated as interchangeable measures.
Track Fixes and Final Counts
The next clear measure is the finalized October record count, alongside continued tracking of which records are rejected, amended or linked to a released fix. For security teams, the more immediate next step is to check vendor advisories and apply relevant updates rather than rely on the headline CVE total to judge exposure.
Further reporting would need to compare patch status over time and document confirmed exploitation, while distinguishing AI-assisted discovery from AI-generated claims or candidate findings. The analysis also points to clearer finder attribution as a way to improve future assessments. Until those data are available, the scale of AI’s contribution and the overall pace of remediation remain uncertain.
Key Questions
How many CVEs were published in October 2026?
The analysis counts 13,934 records from Oct. 1 through Oct. 25. It also gives a separate October tally of 13,766 published records plus 202 later rejected; the source does not fully reconcile these totals. Its estimate of about 17,000 for the full month is a projection, not a final count.
Does the increase prove AI found most of the vulnerabilities?
No. The analysis says 46% of October records name a finder, and 1.4% explicitly credit an AI lab or AI security firm. Those records cannot reliably measure all AI involvement, so the contribution of AI to the overall surge remains unknown.
What is the patch gap cited in the report?
Anthropic’s dashboard listed 6,157 vulnerabilities reported to maintainers, of which 516 were patched to the company’s knowledge. The source does not give a complete status for the others, so they should not all be assumed to remain unpatched.
Does a higher CVE count mean attacks are increasing at the same rate?
No. CVE publication counts track disclosed vulnerability records, not confirmed exploitation. The supplied analysis says CISA’s Known Exploited Vulnerabilities catalog grew less dramatically than the CVE curve, but the provided figures are insufficient to calculate a direct comparison.
Source: ThorstenMeyerAI.com
