VulnCheck: seven months of Anthropic's Glasswing yield 217 fixes from nearly 38,000 findings

VulnCheck has published a seven-month review of Anthropic's Project Glasswing, the AI vulnerability-discovery initiative launched on April 7, and its conclusion is blunt: the results do not match the launch narrative. According to VulnCheck, only 442 of the 93,450 CVEs published this year are attributable to Anthropic, roughly half a percent, and just two of those have been seen exploited in the wild.

How the audit was done

VulnCheck began tracking Anthropic-attributed vulnerabilities on April 17, shortly after launch, in an open repository that draws on CVE records, GitHub security advisories, Linux kernel commits and Anthropic's own disclosure ledger, supplemented by manual audits of advisories. That works out to an average of 63 Anthropic-attributed CVEs per month. VulnCheck notes it has counted more than twice as many attributable CVEs as the 217 fixed vulnerabilities Anthropic lists on its own ledger, which is updated only in infrequent bulk batches. Of the 442 CVEs tracked, only CVE-2026-61500 and CVE-2026-26980 appear in VulnCheck's Known Exploited Vulnerabilities feed, about 0.45 percent.

Discovery far outpaces remediation

The ledger figures, as relayed by VulnCheck, show a widening gap between finding bugs and fixing them. Between May and the November 2 update, total findings grew from 23,019 to 37,966, while fixes rose to just 217. Only 7,349 findings, 19.4 percent, have been made public, and duplicates now outnumber fixes by more than seven to one: 1,654 findings are marked as duplicates and another 419 have been withdrawn. Since VulnCheck's previous checkpoint on September 8, Anthropic added nearly 12,000 findings and recorded only 15 additional fixes, while duplicates jumped from two to 1,670, which VulnCheck reads as evidence that the longer findings sit unaddressed, the likelier someone else fixes them first.

VulnCheck also questions the ledger's claimed true positive rate, which rose from 90.8 percent at launch to 94.2 percent even as withdrawals and duplicates accumulated faster than fixes, suggesting triage outcomes may not feed into the published figure. VulnCheck separately reports an apparent bug in the ledger that inflates the number of findings displayed as disclosed.

The triage bottleneck moves downstream

When Anthropic launched its self-service OSS Scanner on October 8, it acknowledged the constraint, saying it had found more than 29,000 candidate vulnerabilities but manually reviewed only about 6,000, with validation limited by available human capacity. According to VulnCheck, nearly 5,000 unverified reports had already gone to maintainers who asked to receive everything in bulk. The scanner's output is model-generated without human review, and Anthropic itself cautions that reports may be incorrect or invalid, meaning the validation bottleneck did not go away but shifted onto the maintainers Glasswing was meant to assist. VulnCheck's September analysis also found a severity gap: Claude rated 91.5 percent of ledger findings as critical or high, while maintainers rated only 51.3 percent that way.

curl offers a ground-truth check

Shortly before the audit was published, curl maintainer Daniel Stenberg announced that the project had received 45 vulnerability reports from Anthropic, of which one was rated medium severity and the rest low. Of the 34 published so far, 19 were marked as not vulnerabilities, six were confirmed at low severity and nine remain awaiting assessment. That is a 55.9 percent false positive rate so far, and none of the confirmed issues rose above low severity. Stenberg is moving the reports to GitHub at a deliberate pace to soften the impact on his team. VulnCheck points out this is not curl's first experience with the program: in May, Stenberg wrote that five earlier findings amounted to a single confirmed vulnerability. VulnCheck is encouraging other maintainers to follow curl's example and publish such reports openly.

Why it matters

This is one of the first sustained, independent datasets on AI-driven vulnerability discovery at scale, and it complicates the marketing story that accompanied Glasswing's launch with claims of thousands of high-severity bugs awaiting disclosure. VulnCheck concedes that AI is genuinely useful for surfacing candidate vulnerabilities, but the measured outcome so far is a sliver of the year's CVEs, almost no in-the-wild exploitation, stalled fixes and a growing review burden pushed onto open source maintainers. It also raises a measurement problem that reaches beyond Anthropic: when self-reported accuracy rates lack independent validation, and a maintainer-assessed batch like curl's rejects a majority of reports, vendor true-positive claims deserve skepticism. For open source projects, the practical lesson is that opt-in AI scanning arrives with a real, unpaid cost in triage time.