VulnCheck: Anthropic's Glasswing has 217 fixes from 37,966 findings

VulnCheck, a vulnerability intelligence vendor, has published a seven-month update on Anthropic's Project Glasswing. The post is written in the first person by an unnamed author who has tracked the project to see whether its claims are "overhyped or grounded in reality". Anthropic launched Glasswing on April 7th, saying it had "identified thousands of additional high- and critical-severity vulnerabilities" that it was working on responsibly disclosing to open source maintainers. The author says they were struck by how little evidence the launch offered.

On April 17th the author began tracking Anthropic-discovered vulnerabilities in an open source repo called Anthropic Credited CVEs, using CVE records, GHSAs, Linux kernel commits and Anthropic's own ledger, plus manual audits of advisories. After seven months the repo holds 442 CVEs attributable to Anthropic, an average of 63 per month. Against the 93,450 CVEs published this year, that is about 0.5%. Anthropic's public ledger lists 217 fixed vulnerabilities, so by the author's count VulnCheck has tracked more than twice as many as Anthropic has disclosed itself.

On whether these bugs matter to attackers, the author checked them against VulnCheck KEV. Only 2 of the 442, or 0.45%, have been exploited in the wild (CVE-2026-61500 and CVE-2026-26980).

The ledger is the core of the critique. When Anthropic launched it in May, it showed 23,019 findings and a 90.8% true positive rate. As of its November 2nd update it shows 37,966 findings and 217 fixes. Only 7,349 findings (19.4%) have been made public. Some 1,654 (4.4%) are marked as duplicates, which the post calls 7.5x more duplicates than fixes, and 419 have been withdrawn. Yet the ledger now claims a 94.2% true positive rate. The author finds that odd and suggests the triage rates behind "True Positives" lack a feedback loop. Since the author's September update, Anthropic added nearly 12,000 findings and recorded just 15 more fixes, while duplicates went from two to thousands. That, the author says, is what the author warned about in September: the longer findings sit, the likelier someone else finds and fixes them first. The author also says a bug on the ledger appears to inflate the number of findings marked as disclosed, and tells readers to check with the "disclosed" filter.

The post then covers Anthropic's OSS Scanner. In its October 8th launch post, Anthropic said it had found more than 29,000 candidate vulnerabilities but manually reviewed only about 6,000, and that it was "bottlenecked on our human capacity to validate these findings." It had already sent nearly 5,000 unverified reports to maintainers who asked for everything in bulk. The scanner is self-service: projects opt in, request a scan and triage the results themselves. Anthropic says the reports are "fully model-generated, without human review or triage" and that "it is possible reports will be incorrect or invalid." The author's reading: the triage bottleneck did not go away, it moved to the maintainers.

curl offers a test case. Three days before the post, Daniel Stenberg, who maintains curl, announced that the project had received a batch of 45 vulnerability reports from Anthropic, one rated medium and the rest low. He is moving them to GitHub at a deliberate pace "to soften the impact for the team", aiming to have all published by the end of the week. Of the 34 published so far, 19 are marked not a vulnerability, 6 are confirmed as low severity and 9 await assessment. The author puts the false positive rate at 55.9% so far, with 17.6% confirmed, all low severity. The author sets this against the 94.2% claimed on the ledger and against the "high- and critical-severity" framing of the launch. The author notes that in May Stenberg wrote that five Mythos findings boiled down to a single confirmed vulnerability. In September, the author adds, Claude rated 91.5% of ledger findings critical or high while maintainers rated only 51.3% that way.

The author's conclusion: AI is a valuable tool for finding vulnerabilities and the author does not discount that, but the evidence still does not match the launch narrative. The CVEs are a sliver of this year's total, almost none are exploited, fixes have stalled while duplicates and withdrawals pile up, and triage is shifting onto the maintainers Glasswing promised to help. The author praises curl for publishing low and medium findings publicly as issues and encourages other maintainers to do the same.

Key facts

VulnCheck's own repo tracks 442 CVEs attributable to Anthropic after seven months, about 0.5% of the 93,450 CVEs published this year; only 2 (0.45%) are exploited in the wild per VulnCheck KEV.
Anthropic's ledger shows 37,966 findings but 217 fixes; 7,349 (19.4%) are public, 1,654 (4.4%) are duplicates and 419 are withdrawn, while the claimed true positive rate rose from 90.8% to 94.2%.
Since the September update Anthropic added nearly 12,000 findings and recorded just 15 more fixes.
Anthropic's OSS Scanner asks maintainers to triage model-generated reports; of 34 published curl reports (from a batch of 45), 19 were marked not a vulnerability, 6 confirmed as low severity and 9 await assessment.
The author, writing for a commercial vulnerability intelligence vendor, says AI is valuable for finding bugs but the results do not match the launch narrative.

Why it matters

Glasswing launched on April 7th with the promise of thousands of high- and critical-severity open source vulnerabilities, and the project is a flagship claim about what frontier models can do for security. This post is a rare outside tally against that claim. Its main point is a gap between discovery and remediation: findings on the ledger grew from 23,019 in May to 37,966, while fixes stand at 217 and only 15 were added in the last two months. The curl results give a rough sense of what happens once a maintainer actually validates the output.

Who it affects

Open source maintainers are the most directly affected. Anthropic has already sent nearly 5,000 unverified reports to maintainers who asked for everything in bulk, and the self-service OSS Scanner puts triage in their hands. curl's Daniel Stenberg has paced the 45 incoming reports to "soften the impact for the team". Security teams and vendors that rely on Anthropic's counts for prioritisation are also affected, since the post argues the ledger's headline numbers (findings, true positive rate) do not reconcile with fixes, duplicates and withdrawals.

How to use it

For maintainers weighing the OSS Scanner, the post's practical lesson is that Anthropic describes the reports as fully model-generated, without human review or triage, and says some may be incorrect or invalid, so budget triage time. The author encourages maintainers to follow curl and publish low and medium findings publicly as issues for transparency. Anyone who wants to check the ledger can use its "disclosed" filter, which the author says shows a bug inflating the disclosed count. VulnCheck's tracking repo is called Anthropic Credited CVEs.

How solid is it

The 442 figure is VulnCheck's own count, built from CVE records, GHSAs, Linux kernel commits, Anthropic's ledger and manual advisory audits; it is not an Anthropic number. The ledger figures (37,966 findings, 217 fixes, 1,654 duplicates, 419 withdrawn, 94.2%) are as of Anthropic's November 2nd update, as read by the author. The curl numbers are a partial snapshot: 34 of 45 reports published, 9 still awaiting assessment, so the 55.9% false positive rate (19 of 34) is explicitly "so far". The post is a first-person argument and says the numbers are "damning"; the 7.5x duplicate-to-fix ratio is the author's figure.

Risks and caveats

The publisher, VulnCheck, sells vulnerability intelligence, and the post does not discuss any conflict of interest. No response from Anthropic to VulnCheck's figures or to curl's results is quoted. The author speculates that a missing feedback loop explains the rising true positive rate, but Anthropic's definition of a true positive and its handling of duplicates and withdrawn findings is not given. A small sample from one project, curl, may not represent other projects; the author says they are curious whether other maintainers see the same. The 0.45% exploited figure covers only VulnCheck KEV. The post does not say all 45 curl reports will prove low value.

“the triage bottleneck didn't go away. It moved to the maintainers.”

— VulnCheck post author, on Anthropic's OSS Scanner