Anthropic's Glasswing project leaves maintainers underwhelmed after seven months

Anthropic's Glasswing project, which aims to find security flaws in open source software, has now been running for seven months. A developer who has followed the effort from the start says the results fall short of the company's initial claims. According to the report, Anthropic announced in April that it had identified thousands of high and critical severity vulnerabilities, but offered little evidence to back that up.

The tracker counted every vulnerability attributed to Anthropic using CVE records, GHSA advisories and kernel commits. After seven months, the total came to 442 CVEs, an average of 63 per month. That is only about 0.5 percent of the more than 93,000 CVEs published this year. What stands out is that Anthropic's own disclosure ledger lists fewer than that, just 217 fixed vulnerabilities.

The bigger question is how dangerous these flaws really are. According to the article, only two of the 442 CVEs have been exploited in the wild. The picture in Anthropic's ledger is also messy: of 37,966 findings, only 217 are marked as fixed while 1,654 are marked as duplicates. The fact that duplicates outnumber fixes 7.5 times over suggests findings sit unaddressed long enough for someone else to find them first.

In an October post, Anthropic acknowledged that human triage of every finding did not scale. The company said it had found more than 29,000 candidate vulnerabilities but manually reviewed only about 6,000, calling its validation capacity a bottleneck. The takeaway is that AI is useful for spotting flaws, but it is not a substitute for the human work of confirming and fixing them.