🔍 Read the full analysis: The AI And Bug Hunter Effect On CVEs: What The Numbers Show on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
The source reports 13,934 CVE records published from Oct. 1–25, 2026, 3.2 times the total for October 2025. The increase is concentrated among a few organizations, and CVE data identifies an AI lab or security firm in only 1.4% of October records. Anthropic says 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge, highlighting the gap between finding bugs and fixing them.
New CVE publications have climbed sharply in 2026, with 13,934 records issued from Oct. 1–25, according to an analysis of National Vulnerability Database and CVE.org data published by ThorstenMeyerAI.com on Oct. 26. The figures show a rapid rise in disclosed software vulnerabilities, but do not establish how much artificial intelligence contributed; the report says only 1.4% of October records explicitly credit an AI lab or security firm.
The analysis counted CVE records by publication date and cross-checked October entries against CVE.org. It says 13,766 October records were published through the date queried, with another 202 later rejected; its separate Oct. 1–25 total is 13,934. The report compares the latter figure with 4,389 records in all of October 2025. It also reports 88,772 records so far in 2026, 78% more than the full-year 2025 total.
The increase is not spread evenly across all software publishers. Microsoft’s October total rose to 1,455 records from 180 a year earlier; Oracle’s reached 1,078, with nearly all published on Oct. 20. GitHub’s total rose to 1,159 from 276, while VulnCheck’s rose to 2,085 from 163. By comparison, the Linux kernel count rose from 660 to 925. The report attributes much of the overall jump to a small number of vendors and vulnerability data organizations.
The data also gives limited information about who discovered the bugs. Of October’s 13,934 records, 6,346 named a finder, while 200 explicitly credited an AI lab or AI security firm. The report cautions that this is a floor, not a measure of AI’s full contribution: more than half the records named no finder, and CVE records are not designed to capture every tool or method used to uncover a flaw.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Fixing Gap Behind the Surge
The increase matters because a vulnerability disclosure is not the same as a vulnerability being fixed. The source cites Anthropic’s dashboard, which said that, as of Oct. 2, the company had reported 6,157 vulnerabilities to maintainers. Of those, 516 were patched to Anthropic’s knowledge. That figure reflects the company’s own tracking and does not establish the status of every reported flaw, but it illustrates how remediation can lag discovery.
A larger volume of disclosures can help software makers and users identify problems, yet it can also make it harder to prioritize work across many products and maintainers. For readers, the practical issue is not simply how many CVEs appear, but whether affected software is in use, whether a fix is available, and whether it has been installed. The source says the public CISA Known Exploited Vulnerabilities catalog grew during 2025, but the provided material does not give a complete current comparison with the 2026 CVE totals. It therefore cannot establish that exploitation is rising at the same rate as disclosures.
The report also describes attackers using inexpensive AI agents to work on older vulnerabilities, citing NorForge and Reuters. That claim points to a separate risk from AI-assisted discovery: attackers may use automation against already known bugs, including ones that remain unpatched. The available material does not quantify how often that is happening.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
FLEXISPOT 32-Inch Electric Standing Desk Converter with Keyboard Tray
Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD
As an affiliate, we earn on qualifying purchases.
How the 2026 Counts Were Built
The author queried the NVD CVE API 2.0 for monthly records dating back to January 2022, counting by publication date and including all statuses. The data was retrieved on Oct. 26, 2026, at 07:16 UTC; October records were cross-checked against CVE.org. The report says 98% of October records carry a 2026 ID and gives a median of 15 days between an ID being reserved and the record being published. These details suggest the jump is not simply a large collection of older records released at once, though they do not explain why publication volume rose.
The report’s monthly figures show the daily publication rate rising from 267 in June to 320 in July, 410 in August and 502 in September. For October through the 25th, it gives a rate of 557 per day. The author describes the increase in the daily rate as slowing in October, to about 11%, after monthly increases of 20% to 28% from June through September. A projection that October could end near 17,000 records is the author’s estimate if the pace holds, not a final count.
A CVE is a public vulnerability record, commonly published through a CVE Numbering Authority after disclosure coordination. The source argues that this makes the increase a defender-side disclosure count: attackers who discover flaws do not file CVEs themselves. But the identity of the organization publishing a record does not necessarily reveal who first discovered the underlying vulnerability.
“That is a floor, not an estimate.”
— Thorsten Meyer, source report
What the CVE Data Cannot Show
The records do not establish AI’s share of the 2026 increase. Only 46% of October entries named a finder, according to the source, and an explicit AI credit may not capture cases where AI tools assisted a researcher without being listed. Conversely, a candidate finding reported by a lab is not automatically a confirmed vulnerability: the source says external firms reviewed 6,123 of Anthropic’s candidates and confirmed 92.7% as real.
The report does not provide enough current CISA data to compare confirmed exploitation directly with the 2026 CVE publication surge. It also does not establish the cause of the jump in records, or show how many disclosed flaws affect systems readers use, have available patches, or remain exposed in practice. The October totals are close to, but not the same as, a final monthly count; records can also be rejected after publication.
Patch Status and Final Counts
The October publication total will become clearer once the month is complete and any subsequent record changes are accounted for. The more consequential updates will be patch-status information from maintainers and changes to public tracking of known exploited vulnerabilities. Organizations using affected software will need to check relevant vendor advisories and apply fixes where available; the CVE count alone does not indicate whether a particular system is exposed.
Further reporting would also be needed to measure AI’s role consistently, including how many findings were generated with AI assistance, independently confirmed, assigned CVE identifiers and eventually patched. For now, the source’s figures establish a sharp rise in disclosures and a substantial reported remediation gap, but not a direct causal link between AI use and the overall surge.
Key Questions
How many CVE records were published in October 2026?
The source reports 13,934 records from Oct. 1–25. It also says 13,766 October records had been published in the NVD data it queried, with 202 later rejected; these figures refer to different record-status handling in the source’s accounting.
Does the increase prove AI is finding most of the vulnerabilities?
No. The source found explicit credit to an AI lab or security firm in 200 October records, or 1.4%. More than half of the records named no finder, so the data cannot measure AI’s full contribution.
Which organizations contributed to the increase?
The report identifies large increases in records associated with Microsoft, Oracle, GitHub and VulnCheck. It says the overall rise is concentrated among a relatively small number of vendors and data organizations.
How many vulnerabilities reported by Anthropic were patched?
Anthropic’s dashboard, as summarized in the source and dated Oct. 2, listed 516 patched vulnerabilities out of 6,157 reported to maintainers, to the company’s knowledge. The figure is Anthropic’s reported tracking, not an independent count of all fixes.
Does a higher CVE count mean more attacks are occurring?
Not by itself. CVE publication counts measure disclosed vulnerability records, not confirmed attacks. The source discusses attacker use of AI agents against older flaws but does not provide figures that establish a matching rise in exploitation.
Source: ThorstenMeyerAI.com
