Anthropic Glasswing: VulnCheck counts 442 CVEs in 7 months, 217 fixes on the ledger
VulnCheck's November review says Glasswing's ledger holds 37,966 findings but 217 fixes, and only 2 of 442 credited CVEs are exploited; Anthropic's side is not yet in the sources.
· 5 min read
Written by AI from the sources linked below. How we use AI
On this page
Seven months after Anthropic launched Project Glasswing, the security firm VulnCheck says the programme's own ledger shows 37,966 findings but only 217 fixes, and that its separate count of CVEs credited to Anthropic stands at 442, about 0.5% of all CVEs published in 2026. The analysis, posted on 9 November 2026 by VulnCheck researcher Patrick Garrity, concludes that AI is a useful bug-finding tool but that the data does not support Glasswing's claims. The post is one side of an argument: VulnCheck sells vulnerability intelligence, and its count rests on its own method. Here is what the numbers say, what they don't, and what maintainers report.
Key points
- VulnCheck counts 442 CVEs attributable to Anthropic since it began tracking on 17 April, about 63 a month and roughly 0.5% of the 93,450 CVEs published in 2026.
- Only 2 of the 442 (0.45%) appear in VulnCheck's exploited-vulnerabilities list: CVE-2026-61500 and CVE-2026-26980.
- Anthropic's public ledger showed 37,966 findings on 2 November, up from 23,019 at launch in May, but only 217 fixes, with 7,349 findings (19.4%) made public.
- Between 8 September and 2 November the ledger gained 11,813 findings but only 15 fixes, while withdrawn findings rose from 245 to 419.
- In curl's batch of 45 Anthropic reports, 34 had been published when VulnCheck wrote: 19 were not vulnerabilities and 6 were confirmed as low severity.
What happened
Garrity's post, a seven-month review, checks Project Glasswing's claims against public data. Glasswing launched on 7 April, giving selected partners access to Anthropic's Claude Mythos Preview model for defensive vulnerability work. VulnCheck began keeping an open-source list of CVEs credited to Anthropic on 17 April, drawing on CVE records, GitHub security advisories, Linux kernel commits, Anthropic's own ledger and manual checks.
The headline figures: 442 credited CVEs, and an Anthropic ledger whose claimed true-positive rate rose from 90.8% at launch to 94.2% on 2 November. VulnCheck argues that rate does not square with the ledger's other columns, because withdrawn and duplicate findings are growing much faster than fixes.
Background
VulnCheck has tracked this before. In April its first tally found 75 CVE records mentioning Anthropic, 40 of them crediting Anthropic researchers. By 21 September The Register reported 225 CVEs on the list and one confirmed exploitation, a critical Ghost SQL-injection bug, CVE-2026-26980. Garrity told The Register that historically about one to two percent of vulnerabilities get weaponised. The November post lifts the count to 442 and the exploited total to two. VulnCheck notes its method has changed over time, so the totals are not strictly comparable.
VulnCheck cites an Anthropic post of 8 October on its open-source scanner, which it says reported over 29,000 candidate vulnerabilities, about 6,000 of them manually reviewed, and nearly 5,000 unverified reports sent to maintainers; Anthropic said it was "bottlenecked on our human capacity to validate these findings". We could not open Anthropic's post itself, so those figures are as VulnCheck quotes them.
The numbers
| findings | |
|---|---|
| Launch (May) | 23019 |
| 8 Sep | 26153 |
| 2 Nov | 37966 |
Source: VulnCheck, seven-month Glasswing review (Anthropic ledger figures)
Findings keep climbing, but the outcomes that matter to users move slowly. VulnCheck's comparison between 8 September and 2 November:
- Fixed: 202 to 217 (+15).
- Made public: 2,736 (10.5%) to 7,349 (19.4%).
- Withdrawn: 245 to 419 (+174).
- Duplicates: 2 to 1,670, though VulnCheck's body text says 1,654 (4.4%) and does not reconcile the two.
VulnCheck also warns the ledger may overstate disclosed findings and suggests checking the "disclosed" filter.
The curl case is the most concrete. According to VulnCheck, Anthropic sent 45 reports, rating one medium and the rest low; maintainer Daniel Stenberg is publishing them gradually. Of the 34 out so far, 19 were not vulnerabilities, 6 were confirmed as low severity and 9 await assessment, which VulnCheck turns into a 55.9% false-positive rate and 17.6% confirmed. That sample is small and unfinished. Separately, Stenberg's own blog credits Anthropic's scanner with a different, more serious find: a use-after-free that became remote code execution, CVE-2026-92392, rated HIGH, reported on 15 September and fixed in curl 8.23.0. His post says it "was found and reported by Luna Tong at Anthropic using their new OSS Scanner".
What it means
For maintainers, the finding rate is no longer the scarce resource; triage is. VulnCheck says the bottleneck has moved from Anthropic to the projects receiving reports, and curl has changed its own process accordingly: from 26 October it handles low and medium reports as public GitHub issues rather than through HackerOne, citing "the current avalanche of vulnerability reports". Stenberg wrote on 22 October that AI-assisted reports are often accurate and must not be ignored, and that "every single one had AI involved to some extent", while the made-up reports of earlier months have stopped since spring.
For readers weighing the hype, the data supports a narrower claim than either camp makes. The tools do find real bugs, including a high-severity curl flaw. But counts of CVEs or findings measure output, not security. VulnCheck also reports a severity gap: in September it found Claude rated 91.5% of ledger findings critical or high, against 51.3% by maintainers.
The Register's September report added two outside data points on the fix side of the problem. It cited a 1Password study of 6,080 patches written by OpenAI's GPT-5.5 and Anthropic's Opus 4.8, in which 26 percent fully resolved the vulnerability and about 54 percent failed, introduced a new vulnerability, or both. It also cited Veracode's finding that across more than 100 models and 80 coding tasks the average security pass rate for AI-generated code was 56 percent. Those studies are about writing fixes rather than finding flaws, so they do not contradict Anthropic's detection claims, but they show why a finding is only the first step.
A note on reading the ledger terms. A "finding" is a candidate vulnerability the model reports. "Made public" means the finding has been disclosed, "withdrawn" means Anthropic later retracted it, and "fixed" means a maintainer shipped a patch. A rising true-positive rate with rising withdrawals is not impossible, but VulnCheck says it deserves an explanation, and that is the question Anthropic has not yet answered in the sources we read.
What we don't know yet
- Why the ledger's duplicate count jumped from 2 to 1,670 in eight weeks, and whether it reflects a counting change.
- How representative curl's 34 published reports are; the sample is small.
- Whether the 442 figure is complete: it depends on VulnCheck's own attribution method.
- Anthropic's response; we found none in the sources we read.
- That VulnCheck sells vulnerability intelligence products, so readers should weigh its framing accordingly.
What to watch next
Watch for the remaining 11 curl reports, for any Anthropic reply to the ledger discrepancies, for further exploitation entries against the 442 CVEs, and for other maintainers adopting curl's approach of publishing low and medium findings.
Sources
Written by
The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.
Read next
Grok Build apps exposed: Claroc says 35,578 grok.me apps open to anyone, incl. SpaceXSI's own
Security firm Claroc says Grok Build's per-app hostnames let researchers list tens of thousands of apps through passive DNS, and nearly 95% opened without sign-in.
audiotale.net team8 min read
AlphaProof Code: DeepMind's Lean proofs of Signal's PQXDH and Triple Ratchet code
DeepMind says AI agents wrote about 6.5 million lines of Lean to verify Signal's handshake and ratchet in compiled code, with clear limits on what is covered.
audiotale.net team6 min read
Fireworks AI breach: attackers reached dev machines via a cloud provider; Notion says under 1% of workspaces hit
Fireworks says a 23 October cloud-provider incident let attackers reach its development machines, exposing billing data, some incomplete model weights and secrets; here is what to rotate.
audiotale.net team7 min read