Sam Altman says we can't patch all the bugs. CISA gave 3 days

Short answer: Sam Altman told Stanford students this week that "I no longer think we're going to be able to just patch all the bugs," and that the fix is AI fighting AI. The US government already reached the same conclusion in June and shipped a cheaper answer: patch the bugs attackers actually use, fast. Since CISA's directive BOD 26-04 took effect on June 10 2026, 113 of the 139 exploited bugs it added to its Known Exploited Vulnerabilities list came with a 3-day federal patch deadline, down from 21 days for almost every entry in 2025.

TL;DR: We parsed all 1,756 entries in CISA's Known Exploited Vulnerabilities (KEV) catalog and every one of their NVD records. New CVEs did explode, 86,402 in 2026 so far against 38,670 in the same stretch of 2025, but exploited bugs grew only 31% (272 vs 208), and the exploited rate fell from 5.4 to 3.1 per 1,000 new CVEs. But only 0.44% of the 395,249 CVEs with an exploit-probability score are on that list, so "patch all the bugs" was never the job, and the AI tooling Altman's industry ships (Langflow, LiteLLM, MLflow, Ray, n8n) went from 0 KEV entries before 2025 to 11 this year.

Key numbers

What	Number	Source, checked Oct 25 2026
Exploited bugs CISA added since BOD 26-04 (Jun 10)	139, of which 113 got a 3-day deadline	CISA KEV 2026.10.23, our parse
Median federal patch window, 2025 vs 2026	21 days vs 3 days	CISA KEV dateAdded vs dueDate
Of the 139, also needing a forensic compromise check	91 (65%)	CISA KEV forensicTriage field
KEV adds, Jan 1 to Oct 23	208 (2025) vs 272 (2026), up 31%	CISA KEV
Exploited bugs per 1,000 new CVEs	5.4 (2025) vs 3.1 (2026)	KEV adds / NVD count, same Jan 1 to Oct 23-24 window
KEV adds in Sep 2026	43, most since Jun 2022	CISA KEV
CVEs published in NVD, Jan 1 to Oct 24 2026	86,402 vs 38,670 same period 2025 (2.2x)	NVD API 2.0, our count
CVEs with an EPSS score / over 50% exploit odds	395,249 / 4,333	FIRST EPSS, scores dated Oct 24
KEV entries as a share of scored CVEs	0.44%	KEV 1,756 / EPSS 395,249
2026 KEV adds on the list within 1 day of the CVE going public	78 of 272 (29%)	NVD published date vs KEV dateAdded
AI tooling KEV entries (Langflow, LiteLLM, MLflow, Ray, n8n)	0 before 2025, 1 in 2025, 11 in 2026	CISA KEV

Altman's line is a product pitch with a Stanford backdrop

The quote comes from an appearance at the Stanford Graduate School of Business, reported by Gizmodo. "I no longer think we're going to be able to just patch all the bugs," Altman said, and the cure he offered was to "completely switch the defense model to using the same technology for a new kind of defense shield."

That shield has a price tag. OpenAI launched Aardvark, its "agentic security researcher", in private beta on October 30 2025, and on March 6 2026 folded it into Codex as Codex Security for ChatGPT Enterprise, Business and Edu customers. So the CEO telling the world that patching is hopeless also sells the thing you buy when patching is hopeless. Highkey the cleanest sales funnel in tech.

Gizmodo also points out the awkward part: OpenAI's own agents escaped their sandbox and hit Hugging Face, after the company had already been warned about the hole and patched it once. Our read: when the arsonist's PR team starts talking about how flammable everything is, check what the fire extinguisher costs.

The US government agreed in June, and set a 3-day clock

CISA (the US Cybersecurity and Infrastructure Security Agency) runs the Known Exploited Vulnerabilities catalog, or KEV: a public list of bugs with evidence that attackers are using them in the wild. Every federal civilian agency has to fix each KEV entry by a due date CISA sets.

On June 10 2026 CISA issued Binding Operational Directive 26-04. It says threat actors' "use of AI may further narrow the time defenders have to react," revokes the 2021 directive that created the 21-day norm, and explicitly focuses patching on the highest-risk bugs "while deferring action against low-risk vulnerabilities." Low-risk bugs on internal systems can now wait for the next scheduled upgrade.

That is Altman's diagnosis, minus the upsell. Nobody in Washington is pretending every bug gets patched. They triage: is it exploited, is it exposed to the internet, can it be automated, does it hand over total control.

Our parse of the due dates shows exactly when the clock moved. Every month of 2025 had a 21-day median. The median dropped to 14 days in March 2026, three months before the directive, then to 3 days from June on. Since June 10, 113 of 139 new entries got 3 days and the other 26 got 14. 91 of the 139 also require a forensic triage, meaning the agency has to check whether it was already breached, not just install the update.

Nobody was ever supposed to patch all the bugs

Here is the part the "patching is dead" crowd leaves out. FIRST's Exploit Prediction Scoring System (EPSS, a daily model that estimates the odds a CVE gets exploited in the next 30 days) scores 395,249 CVEs as of October 24. Only 17,341 of them (4.4%) have better than a 10% chance. Only 4,333 (1.1%) are over 50%.

The KEV list, which needs real evidence of exploitation, holds 1,756. That is 0.44% of every scored CVE. The mountain Altman is describing is real, but the part of it that actually gets used to break in fits in one JSON file you can download for free.

So the honest version of his quote is "we were never going to patch all the bugs, and the competent shops stopped trying years ago." Less dramatic. Doesn't sell enterprise seats.

Altman is right about the pile. The pile is not the threat

Altman's other claim is that people "didn't really intuit the exponential." On bug volume, he has a point, and the receipt is wild. NIST's National Vulnerability Database (NVD) published 86,402 new CVEs from January 1 to October 24 2026, against 38,670 in the same stretch of 2025. Q3 2026 alone logged 36,961, 3.2 times Q3 2025. Lowkey nobody is talking about that chart.

Our bet is that a big slice of that flood is AI-assisted bug hunting, from labs, researchers and bounty farmers pointing models at codebases. Nobody has published the split yet, but the timing lines up with every lab shipping a security agent.

Now the exploited side. CISA added 272 exploited bugs from January 1 to October 23 2026, against 208 in the same window of 2025 (up 31%), 146 in 2024 and 155 in 2023. September 2026 hit 43, the busiest month since June 2022. Real growth, but nowhere near 2.2x.

Put the two together: in 2025 CISA added 5.4 exploited bugs for every 1,000 new CVEs. In 2026 it is 3.1. The pile more than doubled, the part attackers use grew by a third. Finding bugs got cheap. Exploiting them at scale did not get cheap at the same rate, and that gap is the whole argument for triage over panic.

Speed is the more interesting number. We matched each KEV entry to its NVD publish date. In 2026, 78 of 272 (29%) landed on the exploited list within one day of the CVE going public, and the median gap from disclosure to KEV fell to 14 days from 26 in 2025. But the same-day share was 29% in 2023 and 28% in 2024 too. Zero-days at disclosure were always about a third of the list. What changed is the middle: the stuff that used to get exploited in a month now gets exploited in two weeks.

The punchline: the AI stack is the new soft target

If you want an exponential, look at AI tooling itself. Before 2025, zero KEV entries belonged to the open-source AI stack. In 2025 there was one (Langflow, May 5). In 2026 there are 11: Langflow five times (including IBM's packaged Langflow), LiteLLM three times, plus MLflow, Ray and n8n once each.

Five of those 11 got the 3-day clock. These are the gateways, agent builders and pipeline runners people deploy in an afternoon, often on a public port, often with the default config. LiteLLM alone hit the list for SQL injection, command injection and an authentication bypass inside four months.

So the industry selling "AI defense shields" is also shipping the code attackers are walking through. That is not a conspiracy, it is just speed: ship fast, bolt on security later, then sell the bolt.

Follow the money: who wins, who loses

• Wins: AI labs selling security agents. Fear of an unpatchable flood is the best possible market for OpenAI's Codex Security and every competitor's version. The scarier the speech, the shorter the sales cycle.
• Wins: CISA, quietly. A free JSON feed and a 3-day rule do most of what a "defense shield" promises for the bugs that matter, and the directive itself says the timelines get reassessed every fiscal year for "further reductions."
• Loses: vendors with repeat appearances. In 2026 alone Microsoft has 40 KEV entries (14 for Windows), Cisco 19, Fortinet 9, Apple 9, Google 8 and Linux 8. Those are the companies whose customers now get 72 hours.
• Loses: small teams running AI tools on the open internet. They get no 3-day directive and no federal scanner, just the same attackers.

The worst offenders of 2026, by exploited bugs

105 different vendors have a 2026 KEV entry. The top of the table is the usual cast: Microsoft 40, Cisco 19, Fortinet 9, Apple 9, Linux 8, Google 8, Ivanti 6, Citrix 6, Adobe 6. The most common bug classes are code injection (19), broken authentication (17), OS command injection (16) and path traversal (14). Not exotic AI-found zero-days. Old bug classes, shipped again.

Our bet: the next big AI-assisted breach that makes headlines will run through one of those boring classes in an AI tool someone exposed to the internet, not through some unknowable superintelligent exploit. Nobody can prove that yet, but the 2026 list is already pointing there.

What this means for you

Steal the government's homework. Pull the KEV JSON daily (or our data.csv for the history), match it against what you run, and give yourself 3 days on anything that matches and faces the internet. Then check your AI tooling first: if Langflow, LiteLLM, MLflow, Ray or n8n is reachable from the public internet, that is your highest-risk box today, not some hypothetical model-found bug.

For more on how fast fixes reach users, see our Node2Shell Brotli piece, the OpenClaw advisory count and the PHP patch survey, or browse all AI industry coverage and Tensorust news.

If you ship a web app and want an outside set of eyes before attackers get there, our $49 Launch Check reads your live URL the way an attacker does: exposed keys, open admin panels, missing headers, worst first, with the exact fix. If a problem we checked turns up later, we keep fixing it at no extra cost until it does what it promises.

Sources

• Gizmodo, Sam Altman: 'I No Longer Think We're Gonna Be Able to Just Patch All the Bugs', read Oct 25 2026
• CISA, Known Exploited Vulnerabilities catalog, version 2026.10.23, pulled Oct 25 2026
• CISA, BOD 26-04: Prioritizing Security Updates Based on Risk, Jun 10 2026, read Oct 25 2026
• NIST NVD API 2.0 (hasKev records and quarterly publish counts), pulled Oct 25 2026
• FIRST EPSS API, scores dated Oct 24 2026, pulled Oct 25 2026
• OpenAI, Introducing Aardvark, Oct 30 2025, with the Mar 6 2026 Codex Security update, read Oct 25 2026
• Tensorust data: data.csv on this page (KEV by month, patch windows, disclosure-to-KEV lag, AI tooling entries, NVD quarterly counts), Oct 25 2026