🔍 Read the full analysis: How AI Entered The Black October 2026 Story Of CVEs And Crypto Theft on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
The source reports record CVE disclosures and $3.47 billion in October crypto losses, with the FBI attributing the Binance theft to North Korea. It also documents AI’s role in finding some vulnerabilities, while the data does not establish that AI caused the month’s broader rise in disclosures or theft.
An analysis published November 1 says October 2026 set records for public vulnerability disclosures and reported crypto losses, while documented cases show AI tools helped identify some software flaws. The figures do not show that AI caused the overall surge: exploitation rose much more slowly than disclosures, and the FBI attributed the reported Binance theft to North Korea’s TraderTraitor group, not to an AI-discovered flaw.
Thorsten Meyer’s analysis, based on counts from the U.S. National Vulnerability Database (NVD), says 17,060 new CVE records were published in October, compared with 4,273 in October 2025. The count excludes rejected records and uses publication dates. Meyer says the NVD API returned 17,481 October records when rejected entries were included, illustrating how counting rules affect the total.
The rise in records did not match the increase in entries on the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. CISA added 36 vulnerabilities in October, compared with 31 a year earlier. Its January-to-October total reached 282, exceeding the 245 additions for all of 2025. Separately, blockchain security firm CertiK estimated October crypto losses at $3.47 billion after frozen and returned funds, versus $68 million in October 2025. The source says Binance accounted for 96.7% of the October total.
The analysis identifies several AI-related security developments, including Microsoft security-release entries crediting AI models or AI vulnerability research firms, and PHP flaws found through OpenAI’s Patch the Planet program and patched on October 21. It also cites Google’s report that its Big Sleep system found more actionable bugs in Chrome’s JavaScript engine than Google’s in-house fuzzer over six months. These examples establish AI’s role in particular research efforts; they do not establish that AI generated the month’s overall CVE increase.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Rose Faster Than Exploitation
The gap between published vulnerabilities and flaws with evidence of active exploitation matters for defenders interpreting record totals. A CVE record means a vulnerability has been publicly documented; it does not by itself show attackers are using it. CISA’s KEV catalog is a narrower measure, and its October additions rose from 31 to 36 while NVD publications more than quadrupled year over year.
That distinction also limits what can be concluded about AI. The documented cases suggest AI-supported research can contribute to finding and fixing vulnerabilities, but the data presented do not show that AI was responsible for the broad disclosure spike or that every newly listed flaw creates an immediate threat. For organizations, the practical signal is to track reliable exploitation evidence and vendor fixes, rather than treat every new CVE as equally urgent.
The reported crypto losses add a separate warning, but they should not be combined with vulnerability counts as if they measured the same thing. The source says the Binance incident drove most of October’s losses and began with a compromised laptop, challenging any simple claim that the month’s largest theft followed from an AI-found software bug.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Signals
The analysis separates October’s events into three measures: disclosed flaws, vulnerabilities listed as actively exploited, and crypto funds reported stolen. Each reflects a different stage or kind of security incident. Disclosure counts depend on the database and counting method; KEV entries require evidence of exploitation; crypto-loss estimates may change when funds are frozen or returned.
Meyer reports that NVD records from January through October totaled 89,859 in 2026, compared with 39,639 over the same months in 2025. He also notes that automated CVE assignment policies can inflate totals. Citing Google’s threat intelligence group, the analysis says Linux-kernel-related descriptions produced about 5,000 CVEs from January to August 2026, with no observed zero-day exploitation in that set. This is a reminder that record volume alone is not a measure of successful attacks.
The same source cites Google threat intelligence figures showing 141 distinct vulnerabilities disclosed and exploited from January through August 2026, above the 127 counted for all of 2025. It reports an average of 18 exploited vulnerabilities a month in that 2026 period, compared with 10.5 a month in 2025. These figures indicate increased exploitation over that comparison, but they do not erase the much larger difference between the number of disclosures and the subset observed in use.
What the October Counts Cannot Show
The source offers a one-month snapshot and a set of attributed counts, not proof that AI caused October’s records or losses. It does not provide a complete breakdown of how many vulnerabilities were found by AI, how many were fixed before attackers could use them, or how many attacks involved AI tools. The source’s claim that attackers can use AI to turn fixes into exploits within days is presented as a thesis; the supplied figures do not quantify the frequency of that activity.
The reported Binance loss and attribution also need to remain distinct: the source says the FBI attributed the theft to North Korea’s TraderTraitor on October 31, but the material provided does not include the FBI’s underlying statement or a detailed incident account. CertiK’s loss estimate is stated after frozen and returned funds, and may not be directly comparable with figures using another methodology. The analysis also does not establish whether all October NVD, KEV, and loss data are final.
Follow the Fixes and Confirmations
The next useful checks are whether NVD and CISA totals change as records are updated, and whether vendors publish further details about the flaws and fixes cited in the analysis. Security teams can monitor CISA’s KEV catalog and relevant vendor advisories for evidence that vulnerabilities are being exploited, while treating the raw disclosure count as a measure of publication rather than confirmed attacks.
Further reporting on the Binance incident would clarify the theft’s timeline, the basis for the FBI attribution, and how the loss estimate was calculated. Longer-term data will also be needed to determine whether AI-assisted vulnerability research changes the rate at which flaws are found, patched, or exploited. The October snapshot raises those questions but does not settle them.
Key Questions
What does the October CVE record mean?
The source reports 17,060 new NVD records published in October 2026, excluding rejected records. A CVE publication documents a vulnerability; it does not establish that attackers have exploited it.
Did exploited vulnerabilities rise as sharply as disclosures?
No. CISA added 36 vulnerabilities to its KEV catalog in October, up from 31 in October 2025, while NVD publications rose from 4,273 to 17,060. The measures differ, but the comparison shows exploitation evidence grew more slowly than disclosure volume.
What role did AI play in the October story?
The analysis cites specific cases of AI-assisted vulnerability research, including work associated with OpenAI’s Patch the Planet program and Google’s Big Sleep. It does not show that AI caused the overall CVE surge or the Binance theft.
Who was blamed for the Binance theft?
According to the source analysis, the FBI attributed the October 29 theft to North Korea’s TraderTraitor on October 31. The material provided says the incident began with a compromised laptop, not an AI-found vulnerability.
Source: ThorstenMeyerAI.com
