Anthropic-linked CVEs pile up, attackers mostly shrug
VulnCheck finds only one of 225 Anthropic Glasswing-linked CVEs, Ghost SQL injection CVE-2026-26980, exploited in the wild.
VulnCheck researcher Patrick Garrity tracked 225 CVEs credited to Anthropic or Project Glasswing, whose partners use restricted Claude Mythos Preview for defensive bug hunting. Only CVE-2026-26980, a critical SQL injection in Ghost, is on VulnCheck's known-exploited index. Garrity said these disclosures are not producing different threat outcomes than a typical sample, where roughly 1–2% of flaws are weaponized. Separate studies found ChatGPT-5.5 and Claude Opus 4.8 fully resolved vulnerabilities 26% of the time, and Veracode reported a 56% average security pass rate for AI-generated code.
- VulnCheck tracks 225 CVEs credited to Anthropic or Project Glasswing.
- Only CVE-2026-26980, a critical Ghost SQL injection, is confirmed exploited.
- Historically about one to two percent of vulnerabilities are weaponized.
- 1Password found frontier models fully fixed flaws only 26 percent of the time.
- Veracode measured a 56 percent average security pass rate for AI-generated code.
- CVEs
- CVE-2026-26980
- Products
- Ghost
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-26980 | Unauthenticated SQL Injection in Ghost CMS Allows Arbitrary Database Reads | 7.5 | 70% |
From the original article
3 min read at theregister.comOf 225 flaws found by Glasswing and tracked by VulnCheck researcher, just one has confirmed exploitation in the wild
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.