🔍 Read the full analysis: What Rising CVE Numbers Tell Us About AI And Vulnerability Research on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
The source reports 88,772 CVE records published in 2026 through October 25, 78% more than in all of 2025. The rise is concentrated among several large vendors and numbering authorities, while CVE data does not reliably identify whether AI found a flaw. Anthropic says just 516 of 6,157 vulnerabilities it reported to maintainers had been patched to its knowledge.
New CVE records have risen sharply in 2026, with 88,772 published through October 25—78% more than the full-year total for 2025, according to an analysis of NVD and CVE.org records published by ThorstenMeyerAI.com on October 26. The figures show a growing volume of documented software vulnerabilities, but the records do not establish how much of the increase came from artificial intelligence; the source’s central concern is whether maintainers can fix reported flaws quickly enough.
The analysis counted records by publication date and cross-checked October entries against CVE.org. It reports 13,934 records from October 1 to 25, compared with 4,389 across all of October 2025. The figures include records that were later rejected: the author says 13,766 October records remained, with 202 rejected. Those totals refer to different record statuses, so they should not be treated as interchangeable.
The increase is uneven. Microsoft had 1,455 records in October, compared with 180 in October 2025; Oracle had 1,078, compared with 78 a year earlier. GitHub and VulnCheck also recorded sharp increases, while the Linux kernel count rose from 660 to 925. The analysis says Microsoft’s October Patch Tuesday included 1,413 CVEs, citing SecurityWeek. These concentrations mean the overall curve reflects activity by a limited number of large vendors and vulnerability-numbering organizations, not a uniform increase across every software project.
The source describes the monthly pace as steep but says acceleration eased in October: it calculates daily volume growth of 20% from June to July, 28% from July to August, 22% from August to September and about 11% in October so far. Its estimate that October could finish near 17,000 records is a projection, not a final count. The analysis also says 98% of October records carried 2026 identifiers and the median interval between reserving an ID and publication was 15 days.
Infographic 01 · How big the CVE wave really is
The CVE chart is real. Steep, not parabolic.
New vulnerability records have tripled year over year. A handful of big vendors and clearinghouses drive the jump, and the growth rate cooled in October.
New CVE records per month
January 2024 – 25 October 2026 · phones show the last 13 months
Growth of new CVEs per day versus the previous month. Steep, but the acceleration slowed in October: not “parabolic”.
Who publishes the jump
records by CVE Numbering Authority, October vs. October
Microsoft’s October Patch Tuesday fixed a record 1,413 CVEs (SecurityWeek (14 Oct 2026)). The Linux kernel grew far less.
Not a backlog dump
checks on the October 2026 records
- 98% carry a 2026 ID
- 15 days median from reserving an ID to publishing it
- 217 numbering authorities published, vs. 163 in Oct 2025
- 202 records were later rejected (counted, as NVD does)
- ~17,000 if October’s pace holds: a projection, not a count
Sources: NVD CVE API 2.0 (counts by publication date, all statuses, queried 26 Oct 2026); CVE.org records (credits field, fetched 26 Oct 2026); SecurityWeek (14 Oct 2026). Own analysis; raw files and queries in the kit.
Powered by Thorsten Meyer AI
The Fixing Queue Is the Key Risk
A larger count of disclosed vulnerabilities does not, by itself, show that attackers have gained access to more working exploits or that more systems are being compromised. It does mean vendors and open-source maintainers face a larger stream of findings to review, prioritize and repair. The gap between discovery and remediation is a practical measure of exposure: a flaw can remain a risk while a fix is developed, tested and installed.
Anthropic’s dashboard, as described by the source and dated October 2, lists 6,157 vulnerabilities reported to maintainers. The company said that, to its knowledge, 516 had been patched—about one in twelve. That figure is a company-reported status, not an independently verified count of every fix, and it does not establish that all remaining reports are exploitable or equally severe. Still, it points to the workload that can follow successful discovery.
The analysis also notes that CISA’s Known Exploited Vulnerabilities catalog grew more slowly than the CVE count, but the supplied source material does not provide the full current-year comparison. That catalog tracks vulnerabilities known to be exploited, a different measure from the number of records published. Readers should not interpret a rise in CVEs as proof of a matching rise in active attacks.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
As an affiliate, we earn on qualifying purchases.
What CVE Counts Can Show
A CVE is a public identifier for a disclosed vulnerability. The source describes publication as part of coordinated disclosure, often handled by a vendor or another CVE Numbering Authority after a fix or a disclosure deadline. The organization publishing a record is not necessarily the person or tool that first found the flaw. Nor does a CVE count indicate severity, exploitation, the number of affected users or whether a patch is available.
That distinction limits what the 2026 totals say about AI. Of the 13,934 October records examined, 6,346—46%—named a finder, according to the source. It found explicit credit to an AI lab, model or AI security firm on 200 records, or 1.4%: 123 referenced Anthropic or Claude, 65 named AI security firms, and 16 credited OpenAI. The author calls this a floor because records often omit attribution; it is not a reliable estimate of AI’s full contribution.
The source reports that Anthropic’s dashboard listed 29,439 candidate vulnerabilities found by Claude models. External firms reviewed 6,123 and confirmed 92.7% as real, while Anthropic said 6,157 findings had been reported to maintainers. It also cites OpenAI’s Patch the Planet program with Trail of Bits as reporting hundreds of security issues across 19 open-source projects, reviewed by people. These are program and company figures, not an independent count of all AI-assisted vulnerability research.
“The curve is still climbing fast, but the acceleration has slowed, not run away.”
— Thorsten Meyer, ThorstenMeyerAI.com
AI Attribution Remains Incomplete
The database records do not provide a complete account of who discovered each flaw or whether AI played a role. With more than half of October records lacking finder attribution, the 1.4% explicitly credited to AI-related organizations cannot be read as AI’s share of vulnerability discovery. The data also cannot determine how many findings were generated with AI assistance but credited to a human, vendor or project.
Other key details remain unsettled. The supplied material does not give a complete 2026 total for vulnerabilities confirmed as exploited, nor a consistent breakdown of patch status across all newly published CVEs. Anthropic’s patched figure is based on what the company knew, and the source does not independently audit it. Claims about attackers using AI agents or a Chinese open-weight model building exploits are presented in the source through references to NorForge, Reuters and Anthropic, but the material provided here does not include enough detail to assess their methods or scope.
Track Fixes Alongside Disclosures
The next useful checkpoints are the final October publication count and updated records from NVD, CVE.org and CISA. Those sources can show whether the monthly volume continues to rise, but interpreting the trend will require separating new records from rejected entries and accounting for large vendor publication events.
For AI’s role, clearer reporting would include consistent disclosure of the tool or model involved, independent validation of findings, and comparable data on how quickly maintainers issue fixes. Until those details are available, the confirmed development is a sharp rise in published CVE records—not a quantified AI-driven surge in vulnerabilities or proof of a matching increase in successful attacks.
Key Questions
How many CVE records were published in 2026 through October 25?
The source analysis reports 88,772 records through October 25, 2026, which it compares with 2025’s full-year total of 49,500. The analysis says the 2026 figure was 78% higher.
Does the increase prove AI is finding most vulnerabilities?
No. CVE records often do not name a finder. The source found explicit AI-related credit on 200 of 13,934 October records, but says this is a floor, not an estimate of AI’s total contribution.
Are more published CVEs the same as more active attacks?
No. A CVE count tracks published vulnerability records; it does not show how many flaws are being exploited. The source says CISA’s Known Exploited Vulnerabilities catalog grew less sharply, but the supplied material does not give a complete 2026 comparison.
What is known about patching the reported vulnerabilities?
Anthropic said that, to its knowledge, 516 of 6,157 vulnerabilities it reported to maintainers had been patched. That is a company-reported status, not an independent audit or a complete measure of patching across all CVEs.
Source: ThorstenMeyerAI.com
