Anthropic Glasswing shows 217 fixes among 37,966 findings
First merged summary.
Seven months on, Anthropic's Glasswing lists tens of thousands of findings but only 217 fixes, and VulnCheck disputes the claimed hit rate.
Seven months after Anthropic launched Project Glasswing on April 7, VulnCheck counts 442 attributed CVEs—about 0.5% of 93,450 published this year—and says only two were exploited. Anthropic's November 2 ledger lists 37,966 findings, a 94.2% true-positive rate, 7,349 public entries and 217 fixes. Patrick Garrity of VulnCheck counts 5,276 unique validated issues, 1,654 duplicates and 419 withdrawals, and disputes that rate. Hacker News reports findings rose 11,813 from September 8 to November 2 against 15 new fixes; Infosecurity Magazine counts 4,613 entries added in that span. Anthropic cited triage limits, launched OSS Scanner on October 8 and sent thousands of unverified reports. cURL maintainer Daniel Stenberg said 19 of 34 reviewed reports were not vulnerabilities.
- VulnCheck attributes 442 CVEs to Anthropic, about 0.5% of 93,450 this year.
- Hacker News says only two of those 442 tracked CVEs were exploited.
- Public ledger holds 7,349 findings, with 1,654 duplicates and 419 withdrawals.
- Anthropic said October 8 it reviewed about 6,000 of over 29,000 candidates.
- Nearly 5,000 unverified reports went to maintainers who requested them.
- curl rejected 19 of 34 reports and confirmed six as low severity.
Timeline
dated events in the reporting · oldest first- Apr 7, 2026Anthropic launched Project Glasswing. · Hacker News
- Oct 8, 2026Anthropic launched OSS Scanner and disclosed review totals. · Infosecurity Magazine
- Nov 2, 2026Ledger lists 37,966 findings and 217 fixes. · Infosecurity Magazine
What each outlet adds
beyond the shared facts- Hacker NewsCVE share, two exploited CVEs, and curl severity split.
- Infosecurity MagazineGarrity's validated count and Stenberg's review of 45 reports.
- Vendors
- Anthropic
- Organizations
- AnthropicVulnCheckOpenPrinting
Coverage
oldest first · one row per article · UTC- · 22h ago
Hacker News · securityFirst report
Glasswing logs 37,966 findings but only 217 fixes in seven months
Only two of 442 tracked CVEs were exploited, while duplicates and withdrawals far outnumber the 217 marked fixes.
- · 4h ago
Infosecurity Magazine
VulnCheck says Glasswing fixed 217 of nearly 38,000 claimed flaws
Of 5,276 validated ledger entries, Garrity says 217 are fixed, and he disputes Anthropic's 94.2% true-positive rate.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-26980 | Unauthenticated SQL Injection in Ghost CMS Allows Arbitrary Database Reads | 7.5 | 70% | ||
| CVE-2026-61500 | Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same… | 9.3 | 2% | PoC |