🔍 Read the full analysis: Is AI Driving More CVEs? What The Data Says About Bug Hunters on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
The source analysis counts 13,934 CVE records published from Oct. 1–25, 2026, and 88,772 so far this year. The records show a sharp rise in disclosures, but often do not identify who found the vulnerabilities or whether AI helped. The analysis points to patching as a key concern: Anthropic says only 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge.
A review of public vulnerability records found 13,934 CVEs published from Oct. 1–25, 2026, more than three times the total for all of October 2025, but the records do not establish how much artificial intelligence contributed to finding them. The analysis, published by Thorsten Meyer on Oct. 26, points to a second concern beyond discovery: many reported bugs may remain unpatched.
Meyer says he queried the U.S. National Vulnerability Database’s CVE API for records by publication date and cross-checked October entries against CVE.org. The sources agreed on 13,766 published October records, plus 202 later rejected; the article’s total of 13,934 includes the records in its Oct. 1–25 count. The difference reflects the article’s reporting and validation details, and the figures should be read with their stated date range and record status in mind.
The NVD count shows 88,772 records published so far in 2026, compared with 49,372 during all of 2025, according to Meyer’s figures. October’s daily publication rate was 557 through Oct. 25, against 142 per day in October 2025. The author says month-to-month daily growth slowed to about 11% in October after increases of 20% to 28% from June through September. His estimate that October could finish near 17,000 records is a projection, not an observed total.
The increase is uneven across organizations. Meyer counts 1,455 Microsoft records in October, up from 180 in October 2025, and 1,078 for Oracle, up from 78. He also reports increases for GitHub and VulnCheck, while the Linux kernel count rose from 660 to 925. A large share of the month’s total is therefore concentrated among a few vendors and vulnerability-recording organizations rather than spread evenly across software projects.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
Why the Patching Queue Matters
A higher disclosure count can mean that defenders are finding and publishing more flaws, but it does not by itself show that software is less secure or that attacks have risen at the same rate. The operational risk depends on what happens after disclosure: whether affected maintainers can produce fixes, and whether users install them before attackers exploit the bugs.
Anthropic’s dashboard, as reported by Meyer, lists 6,157 vulnerabilities reported to maintainers, of which 516 were patched to the company’s knowledge. That is roughly one in twelve, based on the company’s current tracking. The figure may not capture fixes the company has not learned about, and it is not a measure of every vulnerability found by AI. Still, it illustrates why discovery speed and remediation capacity need to be considered together.
The source also cites reporting by Reuters and NorForge that attackers are using low-cost AI agents against older vulnerabilities. That claim signals a potential risk, but the material provided does not quantify how many attacks those agents enabled. The immediate takeaway is not that AI has caused a proven wave of successful intrusions; it is that faster discovery could put more pressure on already stretched patching processes.
Popular right now
Vitamix Propel Series 750 Professional-Grade Blender, 4 Programs, Black
Dyson Cyclone V10 Origin Cordless Vacuum
Ninja DualZone Smart Air Fryer, 10 Qt, 6-in-1, DZ950
As an affiliate, we earn on qualifying purchases.
How CVE Counts Are Recorded
A CVE is a public identifier for a disclosed vulnerability. Records are generally published through the CVE program by authorized numbering authorities, often vendors, after a coordinated disclosure process. That means the appearance of a CVE is not a direct count of attacks, nor does it necessarily reveal who first discovered the flaw. A criminal may exploit a bug without filing a CVE; a later public record can document the issue and its remediation.
Meyer says that only 6,346 of the 13,934 October records named a finder. In the records he reviewed, 200 explicitly credited an AI lab, AI model or AI security firm: 123 referred to Anthropic or Claude, 65 to security startups, and 16 to OpenAI. Those are documented credits, not a full measure of AI involvement. Records that omit a finder cannot establish whether AI tools played a role.
The article also cites Anthropic’s reported results: external firms reviewed 6,123 candidate vulnerabilities identified by Claude models and confirmed 92.7% as real, while 6,157 had been reported to maintainers. Anthropic says those findings had generated 219 CVE records and 365 GitHub advisories at the time of its dashboard update. OpenAI’s Patch the Planet program with Trail of Bits, meanwhile, reported hundreds of security issues across 19 open-source projects, each reviewed by people, according to the source article.
“The curve is still climbing fast, but the acceleration has slowed, not run away.”
— Thorsten Meyer, summarizing his CVE data review
What the Records Cannot Show
The biggest uncertainty is how much AI contributed to the 2026 increase. Most records do not name a finder, and explicit AI credits cover only a small share. That makes 1.4% a documented-credit count, not a reliable estimate of AI’s total contribution. The source material also does not establish how many of the newly disclosed vulnerabilities have been exploited in the wild.
Meyer cites CISA’s Known Exploited Vulnerabilities catalog as a public indicator of confirmed exploitation and says it has grown far less sharply than the CVE count. The supplied source ends before giving the full comparison figures for 2026, so the scale and timing of that change cannot be independently described here. Nor does the material establish whether the reported patch total captures every fix or how long maintainers take to address the remaining reports.
The October data also cover only part of the month. The projected figure near 17,000 depends on the publication pace continuing and should not be treated as a final count. Record totals can change as entries are added, corrected or rejected.
Tracking Fixes and Exploitation
The next useful measures are the final October CVE total, updated records showing who reported vulnerabilities, and whether the reported flaws receive fixes. Maintainer and vendor disclosures should clarify how many of the vulnerabilities identified through AI-supported work have been patched and how quickly those fixes reach users.
Further updates to CISA’s exploited-vulnerability catalog can help distinguish a rise in disclosure from a rise in known exploitation, though that catalog is not a complete count of attacks. Until more evidence is available, the public data support a clear conclusion about disclosure volume, but not a precise estimate of AI’s share or the scale of resulting harm.
Key Questions
How many CVEs were published in October 2026?
Meyer counted 13,934 records from Oct. 1–25. His cross-check says 13,766 October records were published in the sources, with 202 later rejected. The full-month total was not yet available in the source article.
Does the CVE increase prove AI is finding more bugs?
No. The records show a rise in published vulnerabilities, but most do not identify the finder. Meyer found explicit AI-related credit on 200 October records, a documented count that does not capture uncredited AI assistance.
Are the new CVEs evidence of more cyberattacks?
Not on their own. A CVE records a disclosed vulnerability, not necessarily an attack. The source says CISA’s known-exploited list rose less sharply than CVE disclosures, but the supplied material does not provide the full 2026 comparison.
What is the reported patching gap?
Anthropic’s dashboard, as cited by Meyer, says 516 of 6,157 vulnerabilities reported to maintainers were patched to the company’s knowledge. The figure may not include fixes Anthropic has not been told about.
Source: ThorstenMeyerAI.com
