Windows needed more than 1,000 security fixes in October 2026, but Microsoft swears it’s not “less secure” and warns users against hitting the brakes on Windows updates. The company worries AI will find even more critical bugs as it accelerates its own bug hunting with AI models in an “agentic” mouse-and-rat game.
Microsoft’s wider October 2026 security release addressed 1,413 CVEs across its product portfolio, according to its October Security Update Guide.
Microsoft is not sounding alarms all of a sudden. I’ve been observing these warnings for the past six months, and the most obvious warning landed in July 2026.
Jeremy Chapman, a director at Microsoft 365 who works closely with Windows customers on security, strongly warned against delaying Windows updates. He also noted that Microsoft no longer recommends delaying monthly updates for three days or more because “the risk is real,” and “total addressed vulnerabilities have been on the rise since April this year.”
“If you’re not delivering critical quality updates with security fixes until a couple of weeks after they’ve been issued, that’s ample time for attackers using AI to find and exploit known security gaps,” Jeremy warned.
If you don’t believe Jeremy’s words, take a look at the increasing vulnerabilities every month and compare them to the numbers from 2025. I made this table with the help of Microsoft’s security portal, so it’s accurate and has everything that tells you the current story of Windows security.
| Month | Windows-only patches in 2025 | Windows-only patches in 2026 | YoY |
|---|---|---|---|
| January | 132 | 93 | -29.5% |
| February | 37 | 32 | -13.5% |
| March | 37 | 48 | +29.7% |
| April | 90 | 131 | +45.6% |
| May | 44 | 66 | +50.0% |
| June | 44 | 120 | +172.7% |
| July | 103 | 413 | +301.0% |
| August | 67 | 233 | +247.8% |
| September | 58 | 726 | +1,151.7% |
| October | 134 | 1,123 | +738.1% |
Every new month makes the previous one look less scary, but it also leaves you wondering how much further the number of security issues will increase.
Also, Microsoft is using AI to help develop these fixes, and I wonder if that’s contributing to more bugs for regular users. We’re still seeing Windows bugs affecting consumer features, such as the built-in backup tool File History, which remains broken, or the USB audio bug, which is still not fully patched.
Microsoft says more fixes don’t mean Windows is less secure
According to Microsoft, you should stop assuming Windows is less secure because of thousands of fixes, even as it warns that the number could increase further.
The company argues that Windows is setting a new standard for “vulnerability management,” as it’s making significant progress in AI-enabled analysis of security vulnerabilities. This allows Microsoft and its partners to find bugs at a greater scale.
At the same time, Microsoft acknowledges that “AI is accelerating vulnerability discovery on both sides.”
“It can help defenders find and fix vulnerabilities earlier,” says Nuno Costa, Partner Director, Windows Servicing and Delivery. “It can also help attackers search for vulnerabilities before fixes are available and analyze published fixes after release. All of this increases the importance of timely protection.”
Microsoft says it’s using AI at scale to find bugs in Windows and help engineers patch them faster than ever, but it insists the quality bar is still high, so there’s no compromise in Windows code or the company’s patch testing process.
“The number of CVEs doesn’t tell the full story, though,” Microsoft’s security boss noted in a long document seen by Windows Latest. “We are using AI to examine more code, more deeply.”
“A higher number of CVEs does not mean Windows has become less secure,” the company insists. “It means more vulnerabilities have been discovered and closed, reducing the opportunities attackers have to exploit them.”
Microsoft wants you to believe that more bugs are being found in Windows because it’s examining more code and being transparent about everything.
“Transparency makes those fixes more actionable,” the company argues, noting that the CVE information makes it easier for external researchers and security teams to understand the bugs present on Windows.
At a recent hardware event, Microsoft promised it’s working to make Windows even more secure, but again, don’t expect these numbers to fall. Things will never go back to how they were a few years ago.
Microsoft is using AI to find Windows bugs, but attackers can use it too
Microsoft sounds quite impressed with its own tool called “MDASH,” which is an AI-powered scanner that uses Microsoft’s own security model, plus brings in the best from partners such as Anthropic’s Mythos. It also has specialized agents to find and validate potential vulnerabilities.
However, AI does not mean engineers have been sent home, at least not at this point. Even though AI finds bugs and helps develop fixes, a human engineer is still involved, making the final decisions. AI is also helping engineers quickly find out which versions of Windows are affected by a certain bug and release fixes faster.
Microsoft doesn’t want you to delay these monthly updates because once a new update is released and CVEs, which contain details of the vulnerabilities, are made public, bad actors can analyze the fix using AI and understand the vulnerability.
Microsoft warns that this could happen within hours, which is why it wants you to install updates as soon as they arrive. We heard those words from Jeremy earlier as well, but the company’s data found that fewer than half of the enterprise devices in its sample had installed the security update after two weeks.
I understand that Windows updates can be buggy, but nothing is worse than getting affected by malware or ransomware, so you shouldn’t delay updates for longer than three days. And if you plan to, make sure you browse the internet carefully and run only trusted programs.
