GoKawiilVulnCheck: Anthropic's Project Glasswing has fixed only 217 of 37,966 flagged bugs
VulnCheck's seven-month tracking of Anthropic's Project Glasswing finds 442 CVEs attributed to the effort, about 0.5% of all CVEs published this year, with just two confirmed exploited in the wild. Of 37,966 reported findings, only 19.4% have been made public and 217 marked fixed, while 1,654 were logged as duplicates and 419 withdrawn. Since September, Anthropic added nearly 12,000 new findings but only 15 more fixes, and curl maintainers rejected 19 of 34 published reports as not valid vulnerabilities.
GoKawiil's interpretation of the reporting above, not reported fact.
The widening gap between findings reported and fixes confirmed suggests Project Glasswing may be generating workload for open-source maintainers faster than it resolves real issues, according to VulnCheck's analysis. The rising reported true-positive rate, despite high duplicate and withdrawal counts, raises questions about how Anthropic calculates accuracy, and the curl rejection rate hints that AI-driven vulnerability scanning could be shifting validation burden onto already-stretched maintainer teams rather than easing it.
- Only 217 of 37,966 reported findings have been marked fixed after seven months.
- Duplicates (1,654) outnumber fixes nearly eightfold, and 419 findings were withdrawn.
- Curl maintainers rejected 19 of 34 published reports as invalid vulnerabilities, questioning Anthropic's claimed 94.2% true-positive rate.
Source: vulncheck.com, 2026-11-10
Published there as: “After 7 Months, Glasswing Overwelms Maintainers with Underwhelming Findings”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.