Disclosures count published CVE records from 21 major reporting organisations. High means CVSS 7.0–8.9; Critical means 9.0–10.0. Dates are publication dates, not discovery dates. Unknown severity is excluded. Only complete calendar months are plotted; the latest available month is labelled.
The markers identify model releases and security programmes relevant to vulnerability discovery. Testing with Mythos began before its public announcement. They do not establish that every flaw was AI-discovered, or measure how much of the increase a particular model caused. More research and changes in reporting can also increase disclosures. A newly published flaw may have existed for years.
In its 22 May Glasswing update, Anthropic reported more than 10,000 High or Critical findings across itself and its partners, and described verification, disclosure and patching as bottlenecks. Those findings are not the same as published CVEs in this chart. Finding and fixing flaws can improve security; this is not an attack count or a prediction of disruption. Our Cyber Threat Level remains a separate assessment.
Historical counts can change when CVE records are revised. The server checks Epoch AI at most every six hours when the monitor is used; the open page checks every five minutes. If a refresh fails, the last successful chart and its reporting period remain visible with a delayed label.
Adapted from Epoch AI, Data on cyber vulnerabilities (CC BY 4.0), based on CVE records. Blackout Day adds the milestone annotations. Source updated 2 Nov 2026.
View 58 monthly totals
