Glasswing logs 37,966 findings but only 217 fixes in seven months
Original title: After 7 Months, Glasswing Overwelms Maintainers with Underwhelming Findings
Only two of 442 tracked CVEs were exploited, while duplicates and withdrawals far outnumber the 217 marked fixes.
Seven months after Anthropic launched Project Glasswing on April 7, VulnCheck's tracker counts 442 attributed CVEs, about 0.5% of 93,450 CVEs published this year. Anthropic's November 2 ledger lists 37,966 findings and a 94.2% true-positive rate, but only 217 fixes. Since September, nearly 12,000 findings were added against 15 new fixes. Its October 8 OSS Scanner sends fully model-generated reports to maintainers; curl rejected most of a 34-report batch.
Unconfirmed: VulnCheck disputes Anthropic's 94.2% true-positive rate and says a ledger bug may inflate disclosed counts.
- VulnCheck attributes 442 CVEs to Anthropic, averaging about 63 per month.
- Only 7,349 findings (19.4%) are public, and 217 are marked fixed.
- Duplicates total 1,654 and withdrawn findings total 419.
- From September 8 to November 2, findings rose by 11,813 while fixes rose by 15.
- curl rejected 19 of 34 published reports and confirmed six as low severity.
- Products
- Project GlasswingOSS Scannercurl
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-26980 | Unauthenticated SQL Injection in Ghost CMS Allows Arbitrary Database Reads | 7.5 | 70% | ||
| CVE-2026-61500 | Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same… | 9.3 | 2% | PoC |
From the original article
6 min read at vulncheck.com
VulnCheck Community gives you free access to VulnCheck KEV, NVD++, Initial Access Community, and VulnCheck XDB Seven months into Project Glasswing, VulnCheck has tracked 442 CVEs attributable to Anthropic, roughly 0. 5% of all CVEs published this year, with only two identified as exploited in the wild. Of Anthropic’s 37,966 reported findings, only 7,349 (19.
By panic · vulncheck.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.