Seven Months In, Glasswing's Bug Finds Fall Short and Burden Maintainers

At a glance

Seven months after launch, a tracking report on Anthropic's Project Glasswing has been published. It found 442 security flaws (CVEs), but only 2 were confirmed as actively exploited. Discoveries rose sharply while fixes grew only slightly, and the review workload is shifting onto open-source maintainers.

Key points

1. 1

   The 442 tracked CVEs are about 0.5% of this year's total.

2. 2

   Anthropic's discoveries rose by about 12,000 since September, but fixes increased by only 15.

3. 3

   Of 34 reports curl published, 19 were not vulnerabilities and only 6 were confirmed as low-severity flaws.

4. 4

   Anthropic sends unreviewed, model-generated reports to maintainers through OSS Scanner.

Why it matters

There is still little public evidence of how well AI finds vulnerabilities, and who bears the cost of checking its findings matters.