Patch Tuesday crossed 1,000 CVEs. AI is why, and it isn't slowing down.

If you patch Windows, your monthly change just got ten times bigger. In January, Microsoft fixed 113 CVEs on Patch Tuesday. Yesterday it fixed 1,093.

That isn't Windows getting worse. It's AI getting very good at finding bugs, and that part isn't going back in the box. The CVE count is the headline. The real story is what all that change does to your apps, your scripts and your two-week window.

See every change proven with your own apps

 We’ll run this month’s update against your real workflows, live, and you keep the receipts. 

The number went vertical in July

For six months, a big Patch Tuesday was about 200 CVEs. Then July shipped 569, and nothing since has come close to the old normal. October set the record at 1,407, more than twelve times January.

That's 5,160 CVEs in eleven releases, and 4,431 of them landed in the last five. All counts are Tenable's Microsoft-only figures. Headline totals that include Chromium and other third-party fixes run higher (1,411 in October and 1,235 in November, per BleepingComputer). Whichever count you pick, the line isn't flat.

Windows didn't get twelve times worse. The bug hunters got AI.

A step that sharp, over a single summer, doesn't look like worse code. It looks like a change in how bugs get found. The timeline lines up:

• May: Anthropic said its Claude Mythos Preview model had helped about 50 partners find more than 10,000 high- or critical-severity vulnerabilities through Project Glasswing. That's the vendor's own count, but it's a big one.
• May: Microsoft's own agentic scanner, MDASH, which runs more than 100 AI agents, surfaced 16 previously unknown Windows flaws that were patched that month.
• June: Microsoft credited a bug to OpenAI's Codex, one of the first publicly attributed AI-reported flaws in a major Patch Tuesday. Dark Reading's headline that month was “Blame AI”.
• November: this month's exploited Outlook zero-day was reported by a researcher who, per Tenable, used Claude.

AI is also on the fixing side. Microsoft says AI now helps its engineers with remediation, though they still review the work. Cheaper finding plus faster fixing means more CVEs per release. ZDI's Dustin Childs put it plainly: AI is “accelerating bug-hunting on both sides of the fence.”

One fair caveat. Not everyone thinks AI explains all of it, and Fortra's Tyler Reguly called it “a slight difference” back in June. That was before July happened.

Don't wait for it to come back down

I keep hearing people treat October as a spike. I don't think it is. The models that found these bugs aren't getting worse, they're getting cheaper, and every vendor is pointing them at its own code now.

Microsoft itself told customers in May that patch volume would “continue trending larger for some time.” Anthropic expects its open-source finding count to keep rising too. In June, Tenable's Satnam Narang said he'd expect 100-plus CVEs a month to become the norm. We blew through that by a factor of ten within a quarter.

And the clock got shorter at the same time. Microsoft now warns attackers can build exploits from a published fix potentially within hours. Its own data from August says fewer than half of enterprise devices had the update two weeks after release. So you're being asked to ship ten times the change, faster, with the same team. Honestly, that math doesn't work by hand.

The CVEs won't break you. The changes riding along with them will.

Every one of those fixes is a change to code your apps depend on. This month's release shows how quietly that bites.

PowerShell script signing got stricter. The Windows 10 ESU and LTSC update (KB5131096) adds stricter UTF-8 validation for signed scripts. Badly encoded scripts can now fail their signature check. Think about the install wrappers written by someone who left in 2019, the Intune detection scripts, and the “fix this” script you pushed at 4pm on a Friday and never thought about again. A stray BOM or a pasted smart quote is enough. Nobody owns those scripts, so nobody notices until the ticket comes back with a different title.

Memory integrity (HVCI) is switching on for more devices. The Windows 11 update (KB5132061) widens HVCI to more eligible machines. That's good security. It's also a classic way for an old driver-dependent app to install cleanly and then just not work.

DPAPI has a deadline. Prompt-based DPAPI now warns ahead of its retirement in April 2027. That date will arrive faster than you think.

Microsoft lists no known issues for Windows 11 this month. That means nobody has told Microsoft yet. It doesn't tell you anything about your apps.

What I'd do before this month hits your broad rings

You can't read 1,093 release notes and reason about each one by hand. You need the same checks, every month, on real endpoints.

1. Run your install and uninstall scripts on a Windows 10 ESU or LTSC test device, and watch signature validation specifically.
2. Search your script repos, Intune and ConfigMgr for signed scripts. Re-save and re-sign anything with a BOM or non-ASCII characters.
3. Test your key apps on a Windows 11 device with memory integrity on, especially anything with a driver or kernel component.
4. Find where you call prompt-based DPAPI before April 2027 finds it for you.
5. Keep a pilot ring that's allowed to break, and actually look at it.

That list is the gap, and it gets longer every month the CVE count goes up. It's the part we built ATP360 for. Your patching and detection tools tell you a change is coming. ATP360 runs your real workflows against it in your tenant, collects the evidence, and hands it to a human who makes the call. Production is never touched. One team took a validation cycle from 3 weeks to 23 minutes. Same build.

AI made finding bugs cheap. Proving your apps still work after the fix shouldn't be the expensive part.

See every change proven on your own apps. We'll run this month's update against your real workflows, live, and you keep the receipts.

P.S. I'm not going to tell you AI will stop the CVE count climbing. It won't. It's why the count is climbing. But the same shift that's flooding Patch Tuesday is what makes checking every change, every month, finally realistic.

Sources

• Monthly CVE counts: Tenable Patch Tuesday reviews, January to November 2026 (linked in the table above)
• BleepingComputer: Windows 11 KB5132061 and KB5131087 cumulative updates released (November 2026)
• BleepingComputer: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
• Anthropic: Project Glasswing, an initial update (May 2026)
• SiliconANGLE: Microsoft patches record 200-plus vulnerabilities as AI accelerates bug discovery (June 2026)
• Dark Reading: Blame AI, Patch Tuesday hits record 206 CVEs (June 2026)
• Security Boulevard: AI fuels record Microsoft Patch Tuesday (October 2026)
• WindowsForum: Microsoft urges faster Windows patching as AI speeds up bug discovery (November 2026)
• Microsoft Security Response Center: Security Update Guide