VulnCheck, a vulnerability intelligence firm, has published a seven-month retrospective on Anthropic's Project Glasswing, finding that the AI-assisted vulnerability disclosure program has produced 442 CVEs — roughly 0.5% of all CVEs issued in 2026 — but only two of those have been observed exploited in the wild.
The numbers behind Glasswing #
Anthropic launched Project Glasswing on April 7, 2026, claiming it had "identified thousands of additional high- and critical-severity vulnerabilities" for responsible disclosure to open source maintainers. VulnCheck began tracking attributable CVEs on April 17, using CVE records, GHSAs, Linux kernel commits and Anthropic's own disclosure ledger.
Over seven months, VulnCheck counted 442 CVEs linked to Anthropic researchers or Glasswing, averaging 63 per month against 93,450 total CVEs published in 2026. Anthropic's own ledger, updated November 2, lists only 217 fixed vulnerabilities — less than half the number VulnCheck tracked independently.
Of the 442 CVEs, two appear in VulnCheck's Known Exploited Vulnerabilities catalog: CVE-2026-61500 and CVE-2026-26980. That is an exploitation rate of 0.45%.
Ledger data shows mounting duplicates and withdrawals #
Anthropic's public ledger shows 37,966 total findings as of November 2, up from 26,153 on September 8. In that period, findings made public rose from 2,736 (10.5%) to 7,349 (19.4%), while fixes increased by only 15. The claimed true positive rate rose from 91.4% to 94.2%.
Meanwhile, 1,654 findings (4.4%) have been marked duplicates — 7.5 times the number of fixes — and 419 have been withdrawn. VulnCheck notes the ledger appears to have a bug inflating the "disclosed" count when filtered.
The triage bottleneck shifts to maintainers #
In its October 8 OSS Scanner launch post, Anthropic acknowledged it had found more than 29,000 candidate vulnerabilities but manually reviewed only about 6,000, remaining "bottlenecked on our human capacity to validate these findings." It had already sent nearly 5,000 unverified reports to maintainers who requested bulk delivery.
OSS Scanner makes this explicit: reports are "fully model-generated, without human review or triage" and "it is possible reports will be incorrect or invalid."
curl maintainer's validation gives a ground-truth check #
Daniel Stenberg, maintainer of curl, published results from a batch of 45 Anthropic reports received via OSS Scanner. Of 34 published so far, 19 were marked "not a vulnerability," six confirmed as low severity, and nine remain under assessment. That yields a 55.9% false positive rate to date, with 17.6% confirmed — all low severity.
Stenberg noted he is pacing publication "to soften the impact for the team." In May, he wrote that five earlier "Mythos" findings for curl collapsed to a single confirmed vulnerability.
Anthropic's ledger claims a 94.2% true positive rate. In September, VulnCheck found Claude rated 91.5% of ledger findings as critical or high, while maintainers rated only 51.3% that way.
Anthropic's own validation of 97 critical/high OSS Scanner findings across 48 projects, reviewed by expert penetration testers, found 85 (88%) met its CVD bar; 11 were real but duplicated; one was invalid. The company cites positive feedback from PostgreSQL, OpenSSL, wolfSSL, HotCRP and curl maintainers on early scanner output.
Academic study finds disclosure surge, no exploitation rise #
A working paper by economist Thomas Mosk (Queen Mary University of London), posted to arXiv November 4, analyzes 13 large US firms granted early access to Claude Mythos Preview through Glasswing. Relative to Chinese firms barred from Anthropic models since September 2025, Glasswing firms' monthly vulnerability disclosures rose ~120%. High-impact flaws rose ~2.5x. Median time from identifier reservation to publication fell from 75 to 22 days. Internally found vulnerabilities rose eightfold per firm per month.
Fixing speed did not slow: vendors processed Zero Day Initiative reports at least as fast, and Linux distributions shipped fixes after a median of one day. The probability a Glasswing vulnerability was already exploited at disclosure fell ~70% relative to the comparison group. Exploited-within-one-month rates dropped from 1.42% to 0.50%.
The paper notes several caveats: Chinese firms could use domestic models (DeepSeek V4, GLM-5.2), so the comparison is Mythos access versus other AI tools, not AI versus no AI; Chinese disclosure rules differ; the data show published and fixed flaws, not whether users installed patches; with only 13 treated firms, the exploitation decline is "suggestive rather than established"; and Anthropic reported partners found over 10,000 high/critical flaws in a month — far more than the ~470 extra monthly disclosures the estimates imply — suggesting many remain unfixed. The paper is a single-author working paper without peer review.
What the signal-to-noise ratio means #
Seven months in, the evidence shows an AI-assisted vulnerability pipeline that produces volume but whose real-world impact remains limited. The 442 CVEs represent a sliver of the annual total. Only two have been exploited. Fixes have stalled while duplicates and withdrawals accumulate. The triage burden has moved from Anthropic to open source maintainers, with curl experiencing a majority-false-positive batch.
AI is a genuine tool for vulnerability discovery — the Mosk paper finds defenders found more flaws without slowing fixes, and external researchers shifted effort rather than quitting. But the launch narrative of "thousands of additional high- and critical-severity vulnerabilities" driving imminent risk has not matched the observed exploitation data. As VulnCheck puts it, the receipts keep coming in; they still don't reconcile.
Sources #
1. [After 7-months, Glasswing Overwelms Maintainers with ...](https://www.vulncheck.com/blog/anthropic-glasswing-november-update) (vulncheck.com)
2. [Techmeme](https://www.techmeme.com) (techmeme.com)
3. [Claude Mythos Doubled Bug Finds at Glasswing Firms - i10X News](https://i10x.ai/news/claude-mythos-glasswing-cyber-defense-study) (i10x.ai)
4. [Top Exploited CVEs This Month — Actively Exploited ...](https://securityonline.info/top-exploited-cves) (securityonline.info)
5. [Open Source Patch Tracker (November 2026): Exploited CVEs ...](https://senserva.com/open-source-patch-tracker.html) (senserva.com)
6. [An opt-in vulnerability-finding service for open-source software \ Anthropic](https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source) (anthropic.com)
7. [GitHub - anthropics/oss-scanner · GitHub](https://github.com/anthropics/oss-scanner) (github.com)