Overview
Seven months after Anthropic launched Project Glasswing — its flagship AI-powered open source vulnerability discovery programme — independent analyst Patrick Garrity at VulnCheck has published a detailed accountability review. The headline numbers are striking in their underperformance relative to the original claims: 442 CVEs tracked, representing just 0.5% of all CVEs published in 2026, with only two confirmed exploited in the wild.
Anthropic launched Glasswing in April 2026 with language suggesting a paradigm shift in vulnerability discovery, claiming identification of “thousands of additional high- and critical-severity vulnerabilities.” The VulnCheck analysis — built from an independent open source tracking repository — paints a considerably more modest picture.
Technical Analysis
The core tension in the Glasswing data is the growing gap between discovery volume and remediation:
- 37,966 total findings reported by Anthropic
- 7,349 (19.4%) made public
- 217 marked fixed — fewer than Garrity’s independently tracked 442 CVEs
- 1,654 duplicates (~4.4%), nearly eight times the fix count
- 419 withdrawn findings
- Since September, ~12,000 new findings added with only 15 additional fixes
The maintainer-side data is particularly instructive. The curl project — a high-profile open source target — rejected 19 of 34 Anthropic-submitted reports outright as non-vulnerabilities, confirmed six as low severity, and left nine under assessment. This directly contradicts Anthropic’s claimed true positive rate, which has risen from 90.8% to 94.2% — a figure that appears not to account for duplicates and withdrawn findings in a consistent way.
The OSS scanner model effectively transfers validation labour onto volunteer maintainers, creating a triage burden without commensurate security value at the downstream level.
Framework Mapping
AML.T0047 — AI-Enabled Product or Service: Glasswing is a direct example of deploying an AI system (Claude) as an operational security tool, with real-world consequences for how vulnerability intelligence is generated and consumed.
AML.T0063 — Discover AI Model Outputs: The Glasswing output — CVE reports, GHSA entries, kernel commits — constitutes a large-scale, structured output stream from an AI model that can be audited and gamed.
LLM09 — Overreliance: The curl maintainer data illustrates the risk of downstream actors (or Anthropic itself) over-trusting AI-generated security findings without adequate human validation before disclosure.
Impact Assessment
The direct security impact of Glasswing findings remains low by objective measures: a 0.45% exploitation rate among tracked CVEs provides little evidence that AI-discovered vulnerabilities are delivering material attacker advantage or defender urgency. The larger impact is operational — open source maintainers face an asymmetric burden where AI can generate reports far faster than humans can validate or fix them. This risks desensitising maintainer communities to vulnerability disclosures, a classic signal-to-noise degradation problem.
Mitigation & Recommendations
- Maintainers: Establish formal intake policies for bulk AI-sourced disclosures, including severity thresholds before engagement.
- Security teams: Cross-reference Anthropic-attributed CVEs against VulnCheck KEV before prioritising remediation effort.
- Industry: AI vulnerability programmes should publish standardised true positive rate methodologies that account for duplicates, withdrawals, and maintainer rejections.
- Anthropic: Increase fix-to-finding ratios and cadence of ledger updates to demonstrate operational impact, not just discovery volume.