{"slug": "glasswing-overwhelms-maintainers-with-underwhelming-findings-vulncheck", "title": "Glasswing overwhelms maintainers with underwhelming findings (VulnCheck)", "summary": "VulnCheck's Patrick Garrity reported that Anthropic's Project Glasswing, launched April 7, has produced 37,966 findings of which only 7,349 (19.4%) are public and just 217 have been marked fixed, while 1,654 (4.4%) were marked duplicates and 419 withdrawn. Garrity noted the ledger now claims a 94.2% true positive rate, up from 90.8% at launch, despite duplicates and withdrawals outpacing fixes, and said the triage burden is shifting onto open source maintainers Glasswing promised to help. Garrity concluded that seven months in, the evidence still doesn't match the launch narrative.", "body_md": "Patrick Garrity of VulnCheck has written a [blog\npost](https://www.vulncheck.com/blog/anthropic-glasswing-november-update) that looks at vulnerabilities found by Anthropic's [Project Glasswing](https://www.anthropic.com/glasswing) since it\nlaunched on April 7, and finds it wanting:\n\nOf the 37,966 findings Anthropic reports, only 7,349 (19.4%) have been made public. Just 217 of those have been marked fixed. The more glaring number is that 4.4% (1,654) of the project's findings have already been marked as duplicates, 7.5x more duplicates than fixes. On top of that, 419 findings have been withdrawn. It seems odd that the ledger now claims a 94.2% true positive rate, up from 90.8% at launch, when more findings have been withdrawn or marked as duplicates than fixed, likely a feedback loop missing to the triage rates listed as \"True Positives\".\n\n[...] AI is a valuable tool for finding vulnerabilities, and I'm not discounting that. But seven months in, the evidence still doesn't match the launch narrative. The CVEs are a sliver of this year's total, almost none are being exploited, fixes have stalled while duplicates and withdrawals pile up, and the triage burden is shifting onto the open source maintainers Glasswing promised to help. The receipts keep coming in. They still don't reconcile.", "url": "https://wpnews.pro/news/glasswing-overwhelms-maintainers-with-underwhelming-findings-vulncheck", "canonical_source": "https://lwn.net/Articles/1107173/", "published_at": "2026-11-12 16:26:09+00:00", "updated_at": "2026-11-12 16:49:54.251453+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence"], "entities": ["Anthropic", "Project Glasswing", "VulnCheck", "Patrick Garrity"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/glasswing-overwhelms-maintainers-with-underwhelming-findings-vulncheck", "markdown": "https://wpnews.pro/news/glasswing-overwhelms-maintainers-with-underwhelming-findings-vulncheck.md", "text": "https://wpnews.pro/news/glasswing-overwhelms-maintainers-with-underwhelming-findings-vulncheck.txt", "jsonld": "https://wpnews.pro/news/glasswing-overwhelms-maintainers-with-underwhelming-findings-vulncheck.jsonld"}}