VulnCheck's seven-month tracking of Anthropic's Project Glasswing finds 442 CVEs attributed to the effort, about 0.5% of all CVEs published this year, with just two confirmed exploited in the wild. Of 37,966 reported findings, only 19.4% have been made public and 217 marked fixed, while 1,654 were logged as duplicates and 419 withdrawn. Since September, Anthropic added nearly 12,000 new findings but only 15 more fixes, and curl maintainers rejected 19 of 34 published reports as not valid vulnerabilities.
vulncheck.com
· 2026-11-10
An analysis of Anthropic's public Vulnerability Disclosure Ledger by researcher Patrick Garrity found that Claude Mythos, part of Project Glasswing, has generated 26,153 vulnerability findings since April 2026. Of those, only about 2,736 have entered the disclosure pipeline, roughly 202 have been patched, 245 withdrawn, and 191 await initial reporting to maintainers, leaving nearly 90% of findings unprocessed.
darkreading.com
· 2026-09-09
Security firm VulnCheck discovered three separate backdoor-like implants embedded in firmware made by Shenzhen Zhibotong Electronics (ZBT), whose hardware is resold globally under numerous brand names. The most severe, dubbed ENDLESSDOORS, disguises itself as a Linux kernel process, phones home to a hard-coded command server without authentication or encryption, and grants attackers root-level control over the router. VulnCheck confirmed the flaw is real by hijacking a test router's command channel themselves, and identified it across 20 ZBT-based router models.
tomshardware.com
· 2026-08-28
GoKawiil