On April 7, 2026, Anthropic launched Project Glasswing with the claim: "We have identified thousands of additional high- and critical-severity vulnerabilities that we are working on responsibly disclosing to open source maintainers." Seven months have passed, and the results independently tracked by VulnCheck's Patrick Garrity differ sharply from the launch narrative.
This article reviews VulnCheck's November 9, 2026 blog post, Anthropic's own disclosure ledger, and the curl project's actual report evaluations. CodeBridge did not recompute VulnCheck's tracking numbers, nor independently verified VulnCheck's analysis.
Ledger numbers: 37,966 findings, 217 fixes
Anthropic's disclosure ledger reported 23,019 findings and a 90.8% true positive rate in its May initial release. The most recent update (November 2, 2026) shows 37,966 findings and 217 fixes.
Breaking it down:
| Category | September 8 | November 2 | Change |
|---|---|---|---|
| Total findings | 26,153 | 37,966 | +11,813 |
| Made public | 2,736 (10.5%) | 7,349 (19.4%) | +4,613 |
| Fixed | 202 | 217 | +15 |
| Withdrawn | 245 | 419 | +174 |
| Duplicates | 2 | 1,670 | +1,668 |
| Claimed true positive rate | 91.4% | 94.2% | +2.8 pts |
In two months, Anthropic added over 12,000 findings but fixed only 15 more. Duplicates grew from 2 to 1,670, and 419 were withdrawn. The claimed true positive rate rose from 90.8% to 94.2%, likely because withdrawn and duplicate findings are excluded from the "True Positives" calculation.
VulnCheck's 442 CVEs: 0.5% of annual CVEs
Patrick Garrity of VulnCheck has independently tracked CVEs attributable to Anthropic since April 17, 2026. The Anthropic-Credited-CVEs GitHub repository uses CVE records, GHSAs, Linux kernel commits, and Anthropic's own ledger.
At 7 months, 442 CVEs have been tracked—an average of 63 per month. That's only 0.5% of 93,450 CVEs published in 2026. Since Anthropic's own ledger lists 217 fixes, VulnCheck's tracked number is more than twice what Anthropic has disclosed itself.
Notably, the exploitation rate. Glasswing launched emphasizing the "Mythos era of vulnerability discovery," but whether these vulnerabilities are actually useful to attackers is a different question. Of the 442 Anthropic-related CVEs tracked against VulnCheck's KEV (Known Exploited Vulnerabilities) data, only 2 (0.45%) have been exploited in the wild: CVE-2026-61500 and CVE-2026-26980.
OSS Scanner: triage burden shifted, not eliminated
When human triage hit a limit, Anthropic launched the OSS Scanner on October 8, 2026. Of 29,000 candidates, only 6,000 were manually reviewed, and Anthropic admitted being "bottlenecked on our human capacity to validate these findings."
The OSS Scanner sends bulk, unverified, model-generated reports to projects that opt in. Anthropic is explicit: these are "fully model-generated, without human review or triage" and "it is possible reports will be incorrect or invalid."
The triage bottleneck didn't disappear. It shifted to maintainers.
curl's reality check: 55.9% false positive
curl maintainer Daniel Stenberg announced that the project received 45 vulnerability reports from the Anthropic OSS Scanner. Anthropic rated one as medium severity and the rest as low. Daniel planned to transfer reports to GitHub gradually to "soften the impact for the team."
Of the 34 published reports:
| Assessment | Count | Rate |
|---|---|---|
| Not a vulnerability | 19 | 55.9% |
| Confirmed low severity | 6 | 17.6% |
| Unassessed | 9 | 26.5% |
The false positive rate is 55.9%. Only 17.6% were confirmed, all low severity. This differs sharply from the 94.2% true positive rate claimed on Anthropic's ledger.
In May 2026, Daniel wrote that "five Mythos findings boiled down to a single confirmed vulnerability." This is far from the "high- and critical-severity" framing Glasswing launched with.
Takeaway at 7 months
AI is a valuable tool for finding vulnerabilities. But at 7 months, the evidence doesn't match the launch narrative. The CVEs are a sliver of the year's total, almost none are exploited, fixes have stalled while duplicates and withdrawals pile up, and the triage burden has shifted to the maintainers Glasswing promised to help.
Practical evaluation: how to assess AI vulnerability discovery
When evaluating AI-based vulnerability discovery projects like Glasswing, consider these metrics together:
- Public disclosure rate: What percentage of findings become actual CVEs or GHSA advisories?
- Fix rate: What percentage do maintainers actually accept as fixes?
- False positive rate: What percentage do maintainers reject as "not a vulnerability" (55.9% for curl)?
- Exploitation rate: What percentage appear in KEV (0.45% for Glasswing)?
- Triage burden: How many reports must maintainers process, and what is the average review time?
Note that VulnCheck's analysis was written from a security vendor's perspective. A 0.45% exploitation rate doesn't mean all findings are meaningless. Some vulnerabilities may have low exploitation likelihood but high severity. However, evaluating projects based solely on discovery numbers risks overlooking maintenance costs.
When measuring AI security agent discovery capabilities, track not just discovery counts but valid determination rates, duplicate rates, time to fix, and maintainer review time.
For more on AI-based security analysis, see the Security Analysis course for vulnerability prioritization patterns.