After 7 Months, Glasswing Overwelms Maintainers with Underwhelming Findings

Seven months after Anthropic launched Project Glasswing to find serious vulnerabilities in open-source software, VulnCheck’s tracking suggests the results have not matched the initiative’s high-stakes pitch. It has attributed 442 CVEs to Anthropic, about 0.5% of CVEs published this year, and found that only two have been exploited in the wild. Anthropic’s disclosure ledger lists 37,966 findings, but only 7,349 are public and 217 are marked fixed. Between September and November, the ledger added nearly 12,000 findings but only 15 fixes; it also recorded 1,654 duplicates and 419 withdrawn reports. Despite these figures, Anthropic’s claimed true-positive rate rose from 90.8% to 94.2%.

The account questions whether that accuracy measure reflects what maintainers actually receive, and argues that Glasswing’s human-review bottleneck has shifted onto open-source teams through Anthropic’s model-generated OSS Scanner reports. Curl’s experience offers a concrete test: among 34 published reports, maintainers rejected 19 as not vulnerabilities, confirmed six as low severity, and had nine still under review. The reports also contrast with Glasswing’s launch emphasis on high- and critical-severity flaws. The central argument is not that AI cannot help find vulnerabilities, but that the public evidence so far shows limited real-world exploitation, slow remediation, substantial duplication, and a potentially heavy validation burden for maintainers.