Project Glasswing by the Numbers: VulnCheck’s 442 CVEs vs Anthropic’s Claims, Explained

Seven months after Anthropic launched Project Glasswing, vulnerability intelligence firm VulnCheck has published a sharp retrospective. It counts 442 CVEs credited to Anthropic, only 2 exploited in the wild, and just 217 fixes out of 37,966 findings on Anthropic’s own ledger.

Anthropic’s ledger claims a 94.2% true-positive rate, while VulnCheck points to a 55.9% false-positive rate in one batch of curl reports. Below I lay out both sides fairly, explain why those two numbers are not measuring the same thing, and show what it means for your team.

What Project Glasswing Is

Project Glasswing is Anthropic’s effort to find and fix serious bugs in critical software before attackers can use AI to find them. It launched in April 2026 and uses Claude Mythos Preview, a model Anthropic has not released to the public.

About 50 partners joined, including Cloudflare, Cisco and Mozilla. Anthropic also scans open-source projects and reports bugs to their maintainers. It tracks this work on a public Vulnerability Disclosure Ledger.

At launch, Anthropic said it had “identified thousands of additional high- and critical-severity vulnerabilities”. That bold claim is what VulnCheck has been testing ever since.

Note: want the background on Anthropic’s current models, including Mythos? See my guide to Claude Fable 5.2 and Mythos 5.2.

What VulnCheck Found

The new post is by Patrick Garrity, dated November 9, 2026. VulnCheck has tracked Anthropic-credited CVEs since April 17, using CVE records, GitHub advisories, Linux kernel commits, Anthropic’s ledger and manual audits.

442 CVEs in seven months

VulnCheck counts 442 CVEs attributed to Anthropic, about 63 a month. That is roughly 0.5% of the 93,450 CVEs published so far this year.

Garrity also notes that his count is more than double the 217 fixed vulnerabilities on Anthropic’s ledger. So by this measure, Anthropic may be under-reporting its own fixes, not over-reporting them.

Only 2 exploited in the wild

Just 2 of the 442 CVEs (0.45%) are on VulnCheck’s known exploited list: CVE-2026-61500 and CVE-2026-26980. The second is a critical SQL injection bug in the Ghost publishing platform.

For context, Garrity told The Register in September that historically about 1 to 2% of vulnerabilities get weaponized. So Glasswing’s CVEs have so far been exploited less than a random set of bugs would be.

A big gap in severity ratings

In September, VulnCheck found that Claude rated 91.5% of ledger findings as critical or high. Maintainers rated only 51.3% of the same group that way. That gap matters, because severity decides what gets fixed first.

The Ledger Numbers, Side by Side

Anthropic’s ledger updates in large batches. VulnCheck compared the September 8 snapshot with the November 2 one:

Three things stand out:

• Fixes barely moved: only 15 more fixes in about two months, while findings grew by almost 12,000.
• Duplicates jumped: from 2 to 1,670, which is nearly eight times the number of fixes.
• The accuracy claim rose: from 91.4% to 94.2%, even as duplicates and withdrawals grew. Garrity says it is unclear how those are counted in the rate.

Tip: VulnCheck says the ledger’s “disclosed” count looks inflated and suggests using its “disclosed” filter to check. If you quote ledger numbers, note the snapshot date, because they change in bulk.

94.2% vs 55.9%: Why Both Can Be True

Headlines put these two numbers against each other. But they measure different sets of reports, so a direct comparison is not fair to either side.

Where 94.2% comes from

The 94.2% figure is the true-positive rate Anthropic shows on its ledger. VulnCheck says its exact basis is unclear.

In May, Anthropic explained the method behind an earlier version of this figure: six independent security firms, and in a few cases Anthropic, assessed 1,752 high or critical findings. Of those, 90.6% were valid and 62.4% were confirmed as high or critical.

So that earlier rate covered findings that were reviewed and assessed, not every finding the model produced.

Where 55.9% comes from

The 55.9% figure comes from curl. Lead developer Daniel Stenberg announced 45 reports from Anthropic and is publishing them gradually. VulnCheck counted the 34 published so far:

• Not a vulnerability: 19 reports (55.9%).
• Confirmed, low severity: 6 reports (17.6%).
• Awaiting assessment: 9 reports.

These came from Anthropic’s OSS Scanner, launched October 8. Anthropic itself says those reports are fully model-generated, have no human review, and may be incorrect or invalid.

Anthropic’s Side of the Story

VulnCheck’s post has no direct response from Anthropic. The Register and TechTarget also said Anthropic did not reply before publication. So here is what Anthropic has said in its own posts.

“Fixing is the constraint, not finding”

In its May update, Anthropic wrote that progress “is limited by how quickly we can verify, disclose, and patch the large numbers of vulnerabilities found by AI.” It also said several maintainers were “severely capacity constrained” and asked it to slow down.

Anthropic added that patch counts are likely undercounted, because some fixes ship without advisories. VulnCheck’s own higher CVE count supports that point.

Strong results from some partners

• Mozilla: 271 vulnerabilities fixed in Firefox 150, per Anthropic’s May update.
• wolfSSL: 74 OSS Scanner reports, all but two valid, with five becoming CVEs, according to InfoQ.
• PostgreSQL: a maintainer said several reports “came with fixes we can use nearly as-is.”
• OpenSSL: a representative said raw reports were as good as, and sometimes better than, human-sourced ones.

The OSS Scanner numbers

In its October 8 post, Anthropic said its models found over 29,000 candidate vulnerabilities in six months. About 6,000 were manually reviewed, and nearly 5,000 unverified reports went to maintainers who asked for early access.

Penetration testers also checked 97 critical and high findings across 48 projects. 85 met Anthropic’s disclosure criteria, 11 were real but duplicates, and 1 was invalid. InfoQ notes that is a selected sample, not an accuracy rate for all reports.

What This Means for Security Teams

Strip away the headlines, and both sides agree on more than you might think:

• AI finds real bugs: Garrity says AI is valuable for finding vulnerabilities. Anthropic’s partner results back that up.
• Humans are the bottleneck: both say triage, disclosure and patching are now the slow part.
• Volume is not impact: 442 CVEs with 2 exploited shows that more findings do not mean more danger.
• Severity needs a human check: the 91.5% vs 51.3% gap shows AI severity ratings run hot.

For defenders, this is good news with a cost. Fewer attacks have come from these bugs than feared, but maintainers are drowning in reports. Red Hat’s Michele Chubirka told TechTarget her team’s AI patches were 60% good, 20% needed design changes and 20% were poor.

How to Handle AI-Found Vulnerabilities

Whether you consume CVEs or maintain a project, these steps keep the flood manageable.

1. Patch by exploitation, not by count. Check the CISA KEV catalog and VulnCheck KEV first. Fix anything known exploited, like CVE-2026-26980 in Ghost, before chasing long lists.
2. Check your dependencies. VulnCheck keeps an open-source repo called “Anthropic Credited CVEs”. Compare it with your software bill of materials.
3. Re-rate severity yourself. Treat an AI’s “critical” as a suggestion. Score it against your own exposure and threat model.
4. Demand a reproducer. OSS Scanner reports include a reproducer and often a candidate patch. If a report cannot be reproduced, park it.
5. Write a threat model file. Maintainers enrolled in OSS Scanner can add an optional file that defines scope, untrusted inputs and excluded components, which cuts noise.
6. Review AI patches like any pull request. Run your tests and a human review before merging, since AI fixes are often imperfect.
7. Publish low-severity results. VulnCheck encourages maintainers to share low and medium findings publicly, as curl does, so others can judge the real hit rate.

Warning: unvalidated OSS Scanner findings carry no automatic 90-day disclosure deadline. If one is later validated, the 90 days start when maintainers are notified of the validation.

My Take

I think both sides are partly right. VulnCheck is right that the launch story of “thousands of critical bugs” has not turned into a wave of exploited CVEs, and that 217 fixes from 37,966 findings looks thin.

But pitting 94.2% against 55.9% is not quite fair. One is a ledger-wide claim built on reviewed findings, the other covers unreviewed scanner output on curl, one of the most audited codebases around. Anthropic even labels that scanner output as possibly invalid.

The real lesson is about cost. AI makes finding bugs cheap, but checking and fixing them is still slow, human work. Compare this with OpenAI’s approach in my GPT-6 Cyber explainer, and see MCP security best practices for keeping your own AI tooling safe.

Troubleshooting: Common Problems and Fixes

• Ledger numbers do not match news reports: the ledger updates in bulk batches. Check the snapshot date each source used.
• Duplicate count differs between 1,654 and 1,670: VulnCheck’s own post uses both figures in different places. Quote the table figure and note the snapshot.
• Your project is flooded with AI reports: ask the sender to slow down or pause. Anthropic says some maintainers have already asked, and OSS Scanner projects can pause or withdraw.
• Cannot reproduce a report: mark it as needing more information and move on. A reproducer should be part of every report.
• AI marked a bug critical but it only crashes: re-rate it. Stenberg rated one Anthropic-found curl bug high rather than critical for that reason.
• Not sure if a CVE came from Glasswing: CVE credit fields are not standard. Check VulnCheck’s tracking repo and the advisory text.

Frequently Asked Questions

How many CVEs has Project Glasswing produced?

VulnCheck counts 442 CVEs credited to Anthropic over seven months. Anthropic’s own ledger lists 217 fixed vulnerabilities as of November 2.

Have any Glasswing CVEs been exploited?

Two of the 442 are known exploited, CVE-2026-61500 and CVE-2026-26980. That is 0.45%, below the usual 1 to 2% for vulnerabilities overall.

Is Anthropic’s 94.2% accuracy claim false?

Not necessarily. It describes Anthropic’s ledger findings, while VulnCheck questions how duplicates and withdrawals are counted in it.

Where does the 55.9% false-positive rate come from?

It comes from 19 of 34 published curl reports that turned out not to be vulnerabilities. Those reports came from Anthropic’s unreviewed OSS Scanner.

Why are so few findings fixed?

Both Anthropic and VulnCheck point to human capacity. Triage, disclosure and patching take people, and many maintainers are overloaded.

Has Anthropic responded to VulnCheck?

Not in VulnCheck’s post. Anthropic’s earlier updates say fixing is the bottleneck and that patch counts are likely undercounted.

Should I worry about Glasswing CVEs in my stack?

Patch them like any other CVE, starting with the two known exploited ones. Use KEV lists to set priority rather than raw counts.

Sources

• VulnCheck: After 7 months, Glasswing findings (November 9, 2026)
• Anthropic: Project Glasswing, an initial update
• InfoQ: Anthropic OSS Security Scanner
• TechTarget: Glasswing results put AI “vulnpocalypse” to the test
• The Register: Anthropic-linked CVEs pile up, attackers mostly shrug
• VulnCheck: The Anthropic Glasswing receipts are starting to trickle in
• Dark Reading: Mythos vulnerability firehose hits a human bottleneck