{"slug": "seven-months-on-anthropic-s-project-glasswing-finds-just-two-exploited-cves-and", "title": "Seven months on, Anthropic's Project Glasswing finds just two exploited CVEs and a lot of slop", "summary": "Anthropic's Project Glasswing, launched in April with the Claude Mythos Preview engine to find software vulnerabilities, had produced 37,966 findings but only 217 fixes as of its November 2 update, according to VulnCheck security researcher Patrick Garrity. Garrity reported that just 7,349 (19.4%) of the findings were made public, 1,654 (4.4%) were marked duplicates — 7.5x more duplicates than fixes — and only two vulnerabilities had been exploited in the wild. Anthropic's ledger reported 23,019 findings and a 90.8% true positive rate when it launched in May, and Garrity called the fix rate \"a staggering failure.", "body_md": "Anthropic's use of AI to find software vulnerabilities has led to a tsunami of low-risk CVEs that threatens to overwhelm IT admins trying to patch their systems.\n\nIn April, Anthropic [launched](https://www.anthropic.com/glasswing?ref=thestack.technology) Project Glasswing, which used the Claude Mythos Preview engine to sniff out flaws in code. Patrick Garrity, a security researcher at VulnCheck, has been monitoring the output of Glasswing from the start, and [the results](https://www.vulncheck.com/blog/anthropic-glasswing-november-update?ref=thestack.technology) aren't great - it has found just two vulnerabilities that have been exploited in the wild and the AI engine has provided fixes for comparatively few issues.\n\n“When Anthropic first launched its ledger in May, it reported 23,019 findings and a 90.8% true positive rate. As of its most recent update on November 2, there are 37,966 findings and just 217 fixes. That looks like a staggering failure to me,” he wrote in his report.\n\n“Of the 37,966 findings Anthropic reports, only 7,349 (19.4%) have been made public. Just 217 of those have been marked fixed. The more glaring number is that 4.4% (1,654) of the project's findings have already been marked as duplicates, 7.5x more duplicates than fixes.”", "url": "https://wpnews.pro/news/seven-months-on-anthropic-s-project-glasswing-finds-just-two-exploited-cves-and", "canonical_source": "https://www.thestack.technology/seven-months-on-anthropics-project-glasswing-finds-just-two-exploited-cves-and-a-lot-of-slop/", "published_at": "2026-11-12 08:00:00+00:00", "updated_at": "2026-11-12 08:20:38.211754+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "ai-agents"], "entities": ["Anthropic", "Project Glasswing", "Claude Mythos Preview", "VulnCheck", "Patrick Garrity"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/seven-months-on-anthropic-s-project-glasswing-finds-just-two-exploited-cves-and", "markdown": "https://wpnews.pro/news/seven-months-on-anthropic-s-project-glasswing-finds-just-two-exploited-cves-and.md", "text": "https://wpnews.pro/news/seven-months-on-anthropic-s-project-glasswing-finds-just-two-exploited-cves-and.txt", "jsonld": "https://wpnews.pro/news/seven-months-on-anthropic-s-project-glasswing-finds-just-two-exploited-cves-and.jsonld"}}