🔍 Read the full analysis: AI Is Part Of The CVE Story, But What About The Patch Gap? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A review of NVD and CVE.org records found 13,934 new CVE records published from Oct. 1–25, 2026, while the share explicitly crediting AI labs or security firms as finders was 1.4%. Anthropic says 516 of 6,157 vulnerabilities it reported to maintainers are patched to its knowledge, highlighting that fixing disclosed bugs may lag behind discovery.
A review of public vulnerability records found 13,934 CVE records published from Oct. 1–25, 2026, while Anthropic reported that 516 of 6,157 vulnerabilities it had reported to open-source maintainers were patched to its knowledge. The figures, published by ThorstenMeyerAI.com on Oct. 26, point to a growing discovery volume and a possible gap between reporting software flaws and getting fixes shipped.
The review’s author queried the U.S. National Vulnerability Database (NVD) and cross-checked October records against CVE.org. It counted 13,766 records published in October and 202 records later rejected, producing the review’s total of 13,934 for Oct. 1–25. The sources agreed on the October record data, the author said. The review also reported 88,772 records so far in 2026, 78% more than the full-year 2025 count of 49,000 or so implied by the comparison in the source material.
The increase was concentrated among a few organizations. Microsoft’s October count rose to 1,455 records, from 180 in October 2025; Oracle’s rose to 1,078 from 78. GitHub’s count was 1,159, compared with 276 a year earlier, and VulnCheck’s reached 2,085, up from 163. The review attributed the increases to a small number of vendors and CVE numbering organizations, rather than an even rise across all software publishers.
The data does not identify AI as the cause of most discoveries. Of the October records, 46% named a finder, and 200, or 1.4%, explicitly credited an AI lab or AI security firm as a finder, reporter or tool. The source says that figure is a floor because many records do not name a finder. Separately, Anthropic’s dashboard, as of Oct. 2, listed 6,157 vulnerabilities reported to maintainers and 516 patched to the company’s knowledge. That is a company-reported status count, not an independently verified patch rate.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
Why the Patch Queue Matters
More disclosed vulnerabilities give software maintainers and users more information about weaknesses, but the practical security benefit depends on whether fixes are developed, distributed and installed. The Anthropic figures cited in the report suggest that at least some reported flaws remain without a known patch, although the source does not give a consistent timeframe for the reports or define how “patched” was checked. The count alone cannot show how many flaws are exploitable or how much risk they pose.
The report also cites NorForge and Reuters material describing attackers using low-cost AI agents against older vulnerabilities. That account supports concern about the misuse of automated tools, but the supplied material does not quantify how many attacks used AI or establish that the rise in CVE publications caused a rise in successful intrusions. The operational question for organizations is whether they can prioritize and apply fixes as disclosures accumulate, while accounting for their own systems and exposure.
Products Worth Considering
Apple MacBook Pro 16.2-inch (2026) with M5 Pro Chip
Apple MacBook Pro 14-inch with M5 Max Chip (18-Core CPU, 20-Core GPU), 48GB RAM, 2TB SSD, Space Black
Ledger Nano Gen5 Crypto Wallet, Black
As an affiliate, we earn on qualifying purchases.
How the October Count Was Built
The author counted CVE records by publication date, using the NVD CVE API 2.0 for monthly data from January 2022 and checking October IDs against CVE.org. The query included all record statuses and was retrieved at 07:16 UTC on Oct. 26. The review says 98% of October records carried a 2026 ID and the median interval between reserving an ID and publishing it was 15 days. Those figures argue against the October total being mainly a delayed release of older records, though they do not explain every cause of the increase.
Daily publication volume rose from 267 records in June to 320 in July, 410 in August and 502 in September, according to the review. From Oct. 1–25, the average was 557 records per day. The author described October’s rate of growth as about 11%, slower than the month-to-month increases reported for July through September. A projection that October could finish near 17,000 records was explicitly identified by the author as an estimate, not a final count.
A CVE is a public identifier and disclosure record for a vulnerability; it does not, by itself, say who first discovered the flaw, whether it is being exploited, or whether affected systems have been fixed. The source notes that CVEs are generally issued through coordinated disclosure by a CVE Numbering Authority, often after a vendor has prepared a fix or a disclosure deadline has arrived. That makes CVE publication a measure of disclosed records, not a direct measure of attacker activity or AI’s contribution to research.
What the Records Cannot Show
The available figures do not establish how much AI contributed to the overall increase in vulnerability disclosures. Most October records lacked a named finder, and attribution in a CVE record may not capture all tools or people involved in finding a flaw. The source’s count of explicit AI credits is therefore a documented minimum, not a measure of AI’s total role.
It is also unclear how many of the 6,157 vulnerabilities Anthropic reported remain unpatched today. The dashboard figure cited in the report is dated Oct. 2 and says only that 516 were patched “to its knowledge.” The supplied source does not provide details on severity, affected products, reporting dates, maintainer responses or independent confirmation of patch status. Nor does the material provide a complete comparison of exploitation activity against the record surge; it says CISA’s Known Exploited Vulnerabilities catalog grew by 245 entries in 2025 but gives no comparable 2026 total in the supplied text.
Patch Status and Final October Data
The October publication count will be clearer after the month closes and remaining records are processed. The report’s estimate of nearly 17,000 records for October should be treated as a projection until a final count is available. Further data on disclosure timing, patch availability and exploitation would help distinguish a rise in reported flaws from a rise in immediate security threats.
For the patch-gap question, useful next evidence would include updated maintainer responses, a dated breakdown of which reported flaws have fixes, and information on how quickly organizations deploy them. The source material does not provide a schedule for those updates. Until then, Anthropic’s patch figure remains a company-reported snapshot, while the broader CVE totals describe publication volume rather than the number of systems exposed or attacks in progress.
Key Questions
How many CVE records were published from Oct. 1–25, 2026?
The report counted 13,934 records for that period, based on NVD data cross-checked against CVE.org. It said 13,766 were published in October and 202 were later rejected.
Does the record surge show that AI found most of the vulnerabilities?
No. Only 200 October records, or 1.4%, explicitly credited an AI lab or AI security firm as a finder, reporter or tool. But most records did not name a finder, so the data cannot establish AI’s full contribution.
How many vulnerabilities reported by Anthropic were patched?
Anthropic’s dashboard, as cited in the report and dated Oct. 2, listed 516 patched out of 6,157 reported to maintainers, to the company’s knowledge. The source does not provide independent verification or a full status breakdown.
Does a CVE record mean a vulnerability is being exploited?
No. A CVE is a vulnerability disclosure record and identifier. It does not establish that attackers are exploiting the flaw, that a fix is available, or that affected users have installed one.
Source: ThorstenMeyerAI.com
