🔍 Read the full analysis: A Question Of Scale: AI, Bug Hunters, And Rising CVE Counts on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A source analysis of US vulnerability records counted 13,934 CVEs published from Oct. 1–25, 2026, more than three times October 2025’s full-month total. The records do not establish how much AI contributed to discovery, while one cited disclosure program says only 516 of 6,157 reported vulnerabilities had been patched to its knowledge.
A review of public vulnerability records found 13,934 CVEs published from Oct. 1 through Oct. 25, 2026, compared with 4,389 during all of October 2025, raising questions about the role of AI in software security and whether fixes are keeping pace. The analysis, published Oct. 26 by ThorstenMeyerAI.com, says the records show a rapid rise in disclosures but cannot establish how many vulnerabilities AI systems found.
The analysis queried the National Vulnerability Database (NVD) by publication date and cross-checked October entries against CVE.org. It reports 13,766 October records published as CVEs, with another 202 later rejected; its headline total of 13,934 includes both. The count for Oct. 1–25 works out to 557 records per day, compared with 142 per day in October 2025.
The rise is not evenly distributed across software publishers. The report counts 1,455 Microsoft records in October to date, up from 180 in October 2025, and 1,078 for Oracle, up from 78. GitHub’s count rose from 276 to 1,159, while VulnCheck’s rose from 163 to 2,085. The report says Oracle’s October entries were concentrated on Oct. 20. It attributes much of the increase to a small number of large vendors and vulnerability-numbering organizations.
Records offer limited evidence about who discovered the underlying flaws. Of the October entries, 6,346, or 46%, named a finder, according to the analysis. It counted 200 records, or 1.4%, that explicitly credited an AI lab or AI security firm. The author describes that figure as a floor because records may omit or inconsistently identify researchers and tools.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Patch Queue Is the Main Concern
A higher CVE count means more vulnerabilities are being publicly documented; it does not by itself show that attackers have more newly usable exploits or that software has become less secure. For organizations, however, each disclosure can create work to identify affected systems, prioritize exposure and apply fixes. The pace of publication can strain those processes, particularly when records cover widely used products.
The report points to a possible gap between discovery and remediation. Anthropic’s disclosure dashboard, as cited in the analysis, listed 6,157 vulnerabilities reported to maintainers, of which the company said 516 were patched to its knowledge. That is a status reported by Anthropic, not an independently verified measure of all fixes. It still illustrates why a surge in detection does not automatically translate into safer software: maintainers must confirm findings, develop and test patches, and users must install them.
Attackers’ use of AI is a separate concern from the origins of CVE records. The source cites reporting by Reuters on NorForge and says attackers are applying low-cost AI agents to older vulnerabilities. The supplied material gives no quantified trend in exploitation, so the disclosure totals should not be treated as a measure of attacks.
Products Worth Considering
Jackery Solar Generator 1000 V2 with 200W Solar Panel
Apple iPad Air (2025) 13‑inch Wi‑Fi 256 GB – Space Gray (M3 chip)
DJI Osmo Mobile 8 Standard Combo Phone Gimbal Stabilizer
As an affiliate, we earn on qualifying purchases.
How the October Count Was Built
The analysis used NVD’s CVE API 2.0 to count records by publication date, covering monthly data from January 2022 onward. The figures were retrieved on Oct. 26, 2026, at 07:16 UTC, and October entries were checked against CVE.org. The author says 98% of October records carry a 2026 identifier and that the median time between reserving an ID and publication was 15 days, which the report uses to argue that the surge is not mainly a delayed release of older records.
A CVE is a public identifier and record for a disclosed vulnerability. The report notes that records are generally published through a CVE Numbering Authority, often a vendor, as part of coordinated disclosure. That means the organizations publishing or coordinating records are not necessarily the people who first found the bugs. The source also cites CISA’s Known Exploited Vulnerabilities catalog as a public indicator of vulnerabilities known to be exploited, while cautioning that its growth has not matched the CVE surge.
The analysis says the publication rate rose 20% from June to July, 28% from July to August and 22% from August to September. It puts October’s increase at about 11% so far. Its estimate that October could finish near 17,000 records is a projection based on the current pace, not a final count.
“That is a floor, not an estimate.”
— Thorsten Meyer, describing the limits of CVE attribution
The CVE data does not show what share of the 2026 increase resulted from AI-assisted discovery, more human researchers, changed reporting practices or other causes. The analysis found that 54% of October records did not name a finder, making the identified AI-related credits incomplete. Its figure of 200 records is a count of explicit credits, not a reliable estimate of AI’s total contribution.
The source cites Anthropic as reporting 29,439 candidate vulnerabilities found by Claude models; external firms reviewed 6,123 and confirmed 92.7% as real, according to the company. It says 6,157 findings had been reported to maintainers. Those are company-reported figures, and they do not mean all candidates became CVEs or that every finding was independently confirmed. The source also cites OpenAI’s Patch the Planet program with Trail of Bits as having found “hundreds of security issues” across 19 open-source projects, reviewed by people.
Nor does the supplied material establish how many disclosed vulnerabilities are actively exploited, how quickly patches reach users, or how many reported fixes have been verified. A complete comparison with CISA’s exploitation catalog is not provided: the source says the catalog added 245 entries in all of 2025, but the supplied text cuts off before giving later figures.
Watch Final Counts and Fixes
The October total will become clearer once the month closes and records are checked for later rejection or revision. The near-17,000 estimate is conditional on the current pace holding and should not be treated as a confirmed monthly result.
For a clearer picture of the security impact, readers will need more than publication counts: consistent finder attribution, evidence about exploitation, and reliable tracking of whether reported flaws are patched and fixes reach affected systems. The source does not identify a scheduled update from NVD, CVE.org, CISA or the cited AI labs that would resolve those questions.
Key Questions
How many CVE records were published from Oct. 1–25, 2026?
The analysis counted 13,934 records for that period, including 202 entries later rejected. It separately reports 13,766 published CVE records.
Does the increase prove AI found most of the vulnerabilities?
No. The analysis counted explicit AI lab or security-firm credits on 200 records, or 1.4%, but says more than half of records named no finder. The available data cannot establish AI’s overall share.
Are more CVEs the same as more cyberattacks?
No. A CVE count tracks public vulnerability records, not attacks. The source says CISA’s Known Exploited Vulnerabilities catalog grew less sharply, but the supplied material does not provide a full comparison for 2026.
What is the reported patch status of Anthropic’s findings?
Anthropic’s dashboard, as cited by the analysis, said 516 of 6,157 vulnerabilities reported to maintainers were patched to its knowledge. That is the company’s reported status, not an independent audit.
Source: ThorstenMeyerAI.com
