VulnCheck data shows Anthropic Glasswing fixes lagging behind new vulnerability findings
Tracking of Project Glasswing reveals a widening gap between the volume of reported issues and the number of confirmed remediations in open source projects.
Key points
- VulnCheck tracked 442 CVEs linked to Anthropic, with only two exploited in the wild.
- Since September, Anthropic added 12,000 findings but recorded just 15 additional fixes.
- Only 19.4% of 37,966 reported findings have been made public, with 217 marked fixed.
VulnCheck reported that since September, Anthropic has added nearly 12,000 new vulnerability findings while recording only 15 additional fixes, widening the gap between discovery and remediation efforts.reported This update to the ongoing tracking of Project Glasswing highlights the disparity between reported issues and resolved vulnerabilities.reportedA recent update shows that Anthropic has reported many more vulnerabilities than it has fixed, raising questions about the effectiveness of its scanning tools.The widening delta between discovered and remediated vulnerabilities in Project Glasswing suggests systemic issues in validation and prioritisation workflows.
Evidence: reported
After 7 months, Glasswing overwelms maintainers with underwhelming findingsaifleet-hn-front
Evidence: reported
After 7 months, Glasswing overwelms maintainers with underwhelming findingsaifleet-hn-front
How we got here
Anthropic launched Project Glasswing on 7 April, claiming the identification of thousands of high and critical severity vulnerabilities for responsible disclosure.reported VulnCheck began tracking attributed CVEs on 17 April, shortly after launch, to verify these claims against public data.reported The tracker noted that Anthropic’s own disclosure ledger was updated only in infrequent bulk batches during this initial period.
Evidence: reported
After 7 months, Glasswing overwelms maintainers with underwhelming findingsaifleet-hn-front
Evidence: reported
After 7 months, Glasswing overwelms maintainers with underwhelming findingsaifleet-hn-front
What is new
The November update from VulnCheck shows that of 37,966 reported findings, only 7,349 have been made public.reported Just 217 of these have been marked as fixed. Approximately 1,654 findings were marked as duplicates, nearly eight times the number fixed, while another 419 were withdrawn from the ledger entirely.reported
Evidence: reported
After 7 months, Glasswing overwelms maintainers with underwhelming findingsaifleet-hn-front
Evidence: reported
After 7 months, Glasswing overwelms maintainers with underwhelming findingsaifleet-hn-front
What to watch
Anthropic’s claimed true positive rate has risen from 90.8% to 94.2%, raising questions about how duplicates and withdrawn findings are accounted for in this metric.reported The OSS Scanner shifts validation work to maintainers, with curl rejecting 19 of 34 published reports as vulnerabilities, confirming six as low severity and leaving nine awaiting assessment.reported
Evidence: reported
After 7 months, Glasswing overwelms maintainers with underwhelming findingsaifleet-hn-front
Evidence: reported
After 7 months, Glasswing overwelms maintainers with underwhelming findingsaifleet-hn-front
Availability and limits
Access to the full set of findings remains limited, with only 19.4% of reported issues made public.reported Developers relying on Anthropic’s disclosures face uncertainty regarding the validity of unassessed reports.reported The shift of validation responsibility to maintainers means that many published findings require independent verification before remediation efforts can begin.
Evidence: reported
After 7 months, Glasswing overwelms maintainers with underwhelming findingsaifleet-hn-front
Why it matters
- Developers must assess the reliability of AI-generated vulnerability reports before allocating remediation resources.
- The low fix rate suggests that reported findings may include false positives or low-priority issues.
- Maintainers face increased workload validating findings shifted to them by automated scanning tools.
- The discrepancy between public disclosures and total findings limits transparency for security researchers.
Topics: vulnerability management, open source security, Anthropic, VulnCheck, AI scanning
Updated
Then / now / next
Anthropic launched Project Glasswing in April with claims of identifying thousands of vulnerabilities.
Tracking data shows a significant lag between reported findings and confirmed fixes.
Observers will monitor how Anthropic accounts for duplicates and withdrawn findings in future updates.
Story timeline
- Then Anthropic launched Project Glasswing in April with claims of identifying thousands of vulnerabilities.
- 10 Nov 2026 After 7 months, Glasswing overwelms maintainers with underwhelming findings
- Now Tracking data shows a significant lag between reported findings and confirmed fixes.
- Next Observers will monitor how Anthropic accounts for duplicates and withdrawn findings in future updates.
The strongest doubt
Counterpoint from the sources
Anthropic claims a rising true positive rate, but the high number of duplicates and withdrawals suggests potential over-reporting or validation issues.
For readers
Developers
- Validate AI-reported vulnerabilities before remediation to avoid wasted effort.
- Expect increased workload from maintainers shifting validation tasks.
Researchers
- Track the discrepancy between reported and fixed vulnerabilities for accuracy analysis.
- Monitor how true positive rates are calculated given duplicate counts.
Policy
- Consider transparency requirements for AI-driven vulnerability disclosure programs.
Ask the article
Local keyword search of this article; no generated answers.Did this article give you the evidence you needed?
Your choice stays on this device. No public tally.Questions readers ask
How many CVEs has Anthropic been credited with in Project Glasswing?
VulnCheck tracked 442 CVEs attributable to Anthropic, representing roughly 0.5% of all CVEs published this year.
What percentage of reported findings have been made public?
Only 19.4% of the 37,966 reported findings have been made public, with just 217 marked as fixed.
How has the true positive rate changed?
Anthropic’s claimed true positive rate has risen from 90.8% to 94.2%, though the accounting method is questioned.
Connected stories
Reading receipt
- VulnCheck tracked 442 CVEs linked to Anthropic, with only two exploited in the wild.
- Since September, Anthropic added 12,000 findings but recorded just 15 additional fixes.
- Only 19.4% of 37,966 reported findings have been made public, with 217 marked fixed.
Still open: How does Anthropic account for duplicates and withdrawn findings in its true positive rate?
Still open: What is the actual impact of the OSS Scanner on maintainer workload and validation accuracy?