🔍 Read the full analysis: The Data Behind Rising CVEs And Slower Patching In The AI Era on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The source’s analysis of NVD and CVE.org data reports 13,934 CVE records published from Oct. 1–25, 2026, and 88,772 so far this year. The surge is concentrated among a few vendors and numbering authorities, while incomplete attribution means the records cannot measure AI’s contribution. Anthropic says 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge.
A surge in publicly published vulnerability records is outpacing available evidence about how quickly flaws are fixed, according to an Oct. 26 analysis of U.S. National Vulnerability Database and CVE.org data. The analysis counted 13,934 new CVE records from Oct. 1–25, 2026, while Anthropic said just 516 of 6,157 vulnerabilities it reported to open-source maintainers were patched to its knowledge.
The analysis, published by ThorstenMeyerAI.com, says the October 1–25 count was 3.2 times October 2025’s full-month total of 4,389. It reports 88,772 CVE records published so far in 2026, 78% more than the full-year 2025 figure. These are publication counts, not a direct count of attacks, newly discovered flaws, or vulnerabilities caused by artificial intelligence.
The monthly figures show rapid growth through September, followed by a slower increase in October. The reported daily rate rose 20% from June to July, 28% from July to August and 22% from August to September; the analysis puts October’s increase at about 11%. It says the curve is still rising but does not support describing the trend as mathematically “parabolic.” A projection of nearly 17,000 records for October assumes the month’s pace continues; it is not a final count.
The increase is concentrated among a handful of organizations. Microsoft had 1,455 records in October, compared with 180 in October 2025; Oracle had 1,078, compared with 78. GitHub rose from 276 to 1,159, and VulnCheck from 163 to 2,085. The Linux kernel’s count rose from 660 to 925. The analysis says a large share of Oracle’s October records appeared on one day, Oct. 20.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Patch Gap After Discovery
More public records can help software users identify affected products and track fixes. But a higher CVE count alone does not show that software has become equally more dangerous: a record is a disclosure, not proof of active exploitation, and the monthly increase may reflect changes in reporting and processing as well as vulnerability discovery.
The available patch figures point to a practical concern. Anthropic’s disclosure dashboard, as described in the analysis, listed 6,157 vulnerabilities reported to maintainers and 516 patched to the company’s knowledge as of the source’s reporting. That is about one in twelve, but it is a company-reported figure and does not establish how many issues remain unpatched today, how severe they are, or whether maintainers have fixed issues Anthropic has not recorded as patched.
For security teams, the distinction matters: discovery creates work for maintainers and users, while risk depends in part on whether affected systems are exposed and whether fixes are available and applied. A rising disclosure total is a reason to monitor updates, not a substitute for evidence about exploitation or patch status.
Products Worth Considering
Bose TV Speaker (2nd Gen) Compact Soundbar with Bluetooth and HDMI Connectivity
Sony WH-1000XM4C Wireless Noise-Cancelling Headphones, Black
Jackery Explorer 300 Portable Power Station, 292Wh
As an affiliate, we earn on qualifying purchases.
What CVE Counts Can Show
A CVE is a publicly tracked vulnerability record, generally issued through a CVE Numbering Authority as part of coordinated disclosure. The analysis queried the NVD’s CVE API by publication date and cross-checked October records against CVE.org, retrieving the data on Oct. 26, 2026, at 07:16 UTC. It reports that 98% of October records carry a 2026 ID and that the median interval from reserving an ID to publication was 15 days.
Publication data does not reliably identify who first found each flaw. Of the 13,934 records counted for Oct. 1–25, the analysis found that 6,346, or 46%, named a finder. It counted 200 records, or 1.4%, explicitly crediting an AI lab or AI security firm. The author describes that figure as a floor because records may omit a finder or fail to identify AI involvement.
AI-related security programs have separately reported larger discovery totals. Anthropic’s dashboard, as cited in the analysis, listed 29,439 candidate vulnerabilities found by Claude models; external reviewers confirmed 92.7% of 6,123 reviewed candidates, and the company said 6,157 had been reported to maintainers. The source says those findings had led to 219 CVE records and 365 GitHub advisories so far. OpenAI’s Patch the Planet program with Trail of Bits reported “hundreds of security issues” across 19 open-source projects, with manual review. These figures describe separate programs and cannot be directly equated with monthly CVE totals.
The published record does not establish how much of the CVE increase was caused by AI-assisted discovery. Nearly 54% of the October records in the analysis name no finder, and explicit AI credit appears in only 1.4%. Those limits mean the data cannot support a complete estimate of AI’s role, or a claim that the remaining records were found without AI.
The analysis also cites reporting by NorForge and Reuters that attackers are using inexpensive AI agents against older vulnerabilities, and says Anthropic reported that a Chinese open-weight model could build exploits end to end with weak safeguards. The source material does not provide enough detail to independently assess the methods, scale, or real-world outcomes behind those claims. It does not establish that the rise in CVE publications has produced a comparable rise in confirmed exploitation.
Patch status is also incomplete: the 516 patched figure is Anthropic’s knowledge of fixes for the vulnerabilities it reported, not an independent audit of all maintainers or deployments. The source excerpt does not include the full comparison between CVE growth and entries in CISA’s Known Exploited Vulnerabilities catalog. The precise current scale of exploitation and the duration of the patch gap therefore remain unclear.
Track Final Counts and Fixes
October’s final publication count will show whether the month ended near the source author’s projection of 17,000 records; that estimate depends on the pace continuing and should not be treated as a reported result. Further checks of NVD and CVE.org records can clarify whether vendor and numbering-authority concentrations persist in later months.
For the patching picture, the most useful updates would be maintainers’ reports of fixes, clearer status tracking for the vulnerabilities Anthropic disclosed, and current CISA data on known exploited vulnerabilities. More complete attribution in CVE records would also help researchers test how much AI contributes to discovery. Until such evidence is available, the data supports a sharp rise in published records and a reported patching shortfall, but not a precise measure of AI’s share or the resulting change in attacker activity.
Key Questions
How many CVE records were published in October?
The analysis counted 13,934 records from Oct. 1–25, 2026. That is a partial-month count; the final October total was not available in the source.
Does the increase prove AI caused more vulnerabilities?
No. The CVE counts do not identify AI’s role for most records. The analysis says 46% named a finder and 1.4% explicitly credited an AI lab or security firm, leaving the full contribution unknown.
What does Anthropic report about patching?
Anthropic’s dashboard, as cited in the analysis, listed 6,157 vulnerabilities reported to maintainers and 516 patched to the company’s knowledge. That is a company-reported status, not an independent count of every fix.
Do more CVE records mean more active attacks?
Not by themselves. CVEs document disclosures; they do not establish that a flaw is being exploited. The source discusses claims about AI-assisted attacks on older vulnerabilities, but does not provide enough evidence to quantify their scale.
Source: ThorstenMeyerAI.com
