VulnCheck Glasswing November Update: 442 CVEs, 217 Fixes, curl Triage

VulnCheck researcher Patrick Garrity's November 9, 2026 update on Anthropic's Project Glasswing found 442 CVEs credited to Anthropic, about 0.5% of roughly 93,450 CVEs filed in 2026, with only 2 of the 442 (about 0.45%) matching Known Exploited Vulnerabilities. Anthropic's November 2 disclosure ledger showed 37,966 total findings against just 217 fixes, with duplicates rising from 2 to 1,670 and withdrawals from 245 to 419 since September 8, while Anthropic's claimed true positive rate climbed from 91.4% to 94.2%. Garrity's analysis, which also covers Daniel Stenberg's triage of Anthropic OSS Scanner reports sent to curl (19 of 34 partial results judged not vulnerabilities, 6 low, 9 pending), argues the volume-fix-severity gap still outruns maintainable remediation.

Seven months after Project Glasswing https://explainx.ai/blog/claude-mythos-preview-cybersecurity-glasswing launched, VulnCheck researcher Patrick Garrity https://www.vulncheck.com/blog/anthropic-glasswing-november-update?ref=explainx published a November 9, 2026 follow-up that pairs Anthropic’s public disclosure ledger with CVE attribution , Known Exploited Vulnerability KEV matches, and Daniel Stenberg’s live triage of Anthropic OSS Scanner https://explainx.ai/blog/anthropic-oss-scanner-free-ai-vulnerability-scans-open-source-maintainers-2026 reports sent to curl . The piece does not claim frontier cyber models are useless; it argues the volume–fix–severity story still outruns maintainable remediation. The analysis extends Garrity’s July exploitation report https://explainx.ai/blog/vulncheck-ai-found-bugs-exploit-rate-glasswing-july-2026 , which found AI-assisted public CVEs exploited at roughly the baseline KEV rate . This update adds ledger mechanics : surging duplicates and withdrawals , stalled fixes while findings grow, and maintainer-side validation after Anthropic shifted unreviewed batches to projects that opt in. TL;DR | Question | Answer per VulnCheck Nov 9, 2026 | |---|---| | CVEs credited to Anthropic? | 442 tracked in Garrity’s repo | | Share of 2026 CVEs? | About 0.5% of ~93,450 | | Ledger findings / fixed? | 37,966 / 217 on Nov 2 ledger | | Public on ledger? | 7,349 19.4% | | Known exploited in KEV? | 2 of 442 ~0.45% | | curl OSS Scanner triage partial ? | 19/34 not vulns; 6 low; 9 pending | | Anthropic claimed true positive rate? | 94.2% on ledger vs earlier 90.8% | Agents that act on your behalf need rules. See how explainx helps secure your agents → https://explainx.ai/agentbeam?src=blog note What changed since the April Glasswing launch Anthropic announced Project Glasswing on April 7, 2026 https://www.anthropic.com/news/project-glasswing?ref=explainx , saying partners had already found thousands of high- and critical-severity vulnerabilities heading toward coordinated disclosure. That headline set expectations for maintainers , investors , and lawmakers debating Mythos-class access https://explainx.ai/blog/gpt-6-cyber-vs-claude-mythos-5-glasswing-claude-security-comparison-2026 . Garrity began an independent ledger on April 17 in the open Anthropic Credited CVEs https://github.com/vulncheck-oss/anthropic-credited-cves?ref=explainx repository because Anthropic’s own disclosure ledger https://www.anthropic.com/transparency/vulnerability-disclosure-ledger?ref=explainx updates in infrequent bulk batches . His November post is the fifth in a series; our July coverage https://explainx.ai/blog/vulncheck-ai-found-bugs-exploit-rate-glasswing-july-2026 already compared AI discovery counts to KEV exploitation share . The new numbers focus on remediation throughput and severity alignment , not whether a model can spot a bug in a lab. Ledger growth versus fixes and public disclosure Anthropic’s November 2 ledger snapshot, as summarized by Garrity: | Metric | Sep 8 | Nov 2 | Change | |---|---|---|---| | Total findings | 26,153 | 37,966 | +11,813 | | Made public | 2,736 10.5% | 7,349 19.4% | +4,613 | | Fixed | 202 | 217 | +15 | | Withdrawn | 245 | 419 | +174 | | Duplicates | 2 | 1,670 | +1,668 | | Claimed true positive rate | 91.4% | 94.2% | +2.8 pts | Garrity notes nearly 12,000 findings arrived in roughly two months while only 15 additional fixes registered. Duplicates jumped from two to thousands , matching his September warning that unresolved queues collide with human discovery elsewhere. He also flags 1,654 duplicates 4.4% and 419 withdrawals against 217 fixes , and questions how a rising 94.2% true positive rate squares with withdrawals and duplicates piling up faster than remediated items. Project Glasswing November ledger totals tracked by VulnCheck for Anthropic vulnerability findings Image: VulnCheck https://www.vulncheck.com/blog/anthropic-glasswing-november-update?ref=explainx Builder takeaway: if you ingest Glasswing-style feeds into CI, budget deduplication and severity re-ranking pipelines, not just ticket openers. Our Trail of Bits patching regression work https://explainx.ai/blog/trail-of-bits-patching-bugs-regression-hunt-plugins-21-regressions-130-prs-patch-the-planet-2026 shows fix quality matters as much as find volume. CVE attribution versus ledger marketing On the CVE side, Garrity reports 442 vulnerabilities attributable to Anthropic in his tracker, more than double the 217 fixes Anthropic’s ledger lists. That gap can reflect disclosure timing , non-CVE advisories , and partner-private work , but it is the reference set VulnCheck uses for exploitation math . Against VulnCheck KEV , only two credited CVEs show known exploitation : - CVE-2026-61500 - CVE-2026-26980 also discussed in our July Glasswing exploitation post https://explainx.ai/blog/vulncheck-ai-found-bugs-exploit-rate-glasswing-july-2026 That is 0.45% of the 442-set. Garrity contrasts the Mythos-era danger narrative with public exploit telemetry , while stressing AI still shrinks time-to-patch when triage works. Readers comparing vendors should cross-check OpenAI GPT-6 Cyber exploit pipelines https://explainx.ai/blog/openai-gpt-6-cyber-critical-exploitgym-honeypot-under-1-percent-out-of-bounds-daybreak-red-2026 , Collinear CWE-bench defensive tasks https://explainx.ai/blog/collinear-cwe-bench-v2-100-defensive-patch-tasks-91-cwes-gemini-4-argon-67-8-percent-2026 , and UK AISI cyber eval incidents https://explainx.ai/blog/aisi-mythos-5-gpt-5-6-sol-cyber-eval-incident-august-2026 to see offense-heavy marketing versus patch-loop benchmarks . OSS Scanner: triage moved to maintainers When human review could not scale, Anthropic launched the OSS Scanner https://www.anthropic.com/news/open-source-vulnerability-scanner?ref=explainx on October 8, 2026 , noting 29,000+ candidate findings but only ~6,000 manually reviewed, with ~5,000 unverified reports already emailed to maintainers who requested bulk delivery. Reports are fully model-generated without human triage , per Anthropic’s disclaimer. Garrity’s framing: the bottleneck did not disappear ; it moved downstream to volunteers and corporate maintainers already stretched by PHP2Shell response https://explainx.ai/blog/php2shell-cve-2026-109618-109619-what-happened-what-to-do-now-2026 and routine CVE load. curl gives a ground-truth sample Three days before the VulnCheck post, curl maintainer Daniel Stenberg described receiving 45 vulnerability reports from Anthropic’s scanner path, rating one medium and the rest low , and publishing issues slowly to avoid drowning the team. Of 34 reports published when Garrity wrote: | Outcome | Count | |---|---| | Not a vulnerability | 19 | | Confirmed low severity | 6 | | Awaiting assessment | 9 | That yields a 55.9% false-positive rate on published items so far and 17.6% confirmed , all low severity in the confirmed bucket. Stenberg linked the batch on his blog; Garrity embeds VulnCheck’s chart. curl maintainer triage chart for Anthropic OSS Scanner Glasswing vulnerability reports Image: VulnCheck https://www.vulncheck.com/blog/anthropic-glasswing-november-update?ref=explainx This rhymes with Stenberg’s May note that five Mythos findings collapsed to one confirmed curl issue, and with Garrity’s September severity mismatch: Anthropic labeled 91.5% of ledger items critical or high while maintainers rated 51.3% that way in his earlier sample. If you maintain open source, treat scanner email like untrusted fuzzer output : require reachable exploit paths , default-config impact , and regression tests before issuing CVEs. Our zero-day explainer https://explainx.ai/blog/what-is-a-zero-day-vulnerability-exploit-explained-ai-era-2026 walks disclosure clocks; OSS Scanner explicitly does not run the same coordination timeline. What developers are saying Hacker News readers argued past the headline in both directions on thread 50447074 https://news.ycombinator.com/item?id=50447074&ref=explainx : - sigmar comment 50448708 https://news.ycombinator.com/item?id=50448708&ref=explainx said fast patching can keep KEV counts low, so low exploitation share is not proof of failure . - pizlonator comment 50448745 https://news.ycombinator.com/item?id=50448745&ref=explainx reported nine Fil-C reports from Anthropic , all real bugs with exceptional report quality , contrasting curl’s batch. - simoncion comment 50449972 https://news.ycombinator.com/item?id=50449972&ref=explainx pointed to Greg Kroah-Hartman’s high false-positive anecdotes and argued commenters ignored OSS Scanner stats while debating ledger percentages. - rurcliped comment 50448662 https://news.ycombinator.com/item?id=50448662&ref=explainx said the post mischaracterizes Glasswing because many discoveries happen on private partner code never destined for the public ledger. - enthuseyourcurb comment 50448590 https://news.ycombinator.com/item?id=50448590&ref=explainx , claiming big-tech experience, argued public CVE under-counts company-ending issues that never receive numbers. - delichon comment 50447517 https://news.ycombinator.com/item?id=50447517&ref=explainx worried about a find-versus-fix ratio of 37,966 to 217 if it generalizes. None of these comments are verified facts; they show maintainer burden , metric selection , and private versus public discovery as the live debate. What this means for agent and AppSec teams Discovery tools are not patch tools. If you wire Claude Security https://explainx.ai/blog/claude-security-scan-fix-public-beta-2026 or third-party scanners into repos: 1. Cap auto-ticket rate and require human or policy gate for severity above low. 2. Deduplicate against existing GHSA/CVE before paging on-call. 3. Measure time-to-merge fix PR , not raw finding count OKRs. 4. Separate partner-private red team results from public ledger KPIs when reporting upward. For agent pipelines that write patches, pair scanning with regression harnesses and runtime guardrails. AgentBeam https://agentbeam.com/?ref=explainx focuses on stopping autonomous agents from executing dangerous actions when scanners or coders go haywire; it complements, not replaces, maintainer triage. How to verify the numbers yourself 1. Clone or browse vulncheck-oss/anthropic-credited-cves https://github.com/vulncheck-oss/anthropic-credited-cves?ref=explainx and diff against Anthropic’s ledger CSV exports https://www.anthropic.com/transparency/vulnerability-disclosure-ledger?ref=explainx . 2. Filter the ledger for disclosed versus fixed and compare Garrity’s claim about disclosed inflation using Anthropic’s UI filters. 3. Watch curl GitHub issues filed from the Anthropic batch for final dispositions. 4. Cross-check KEV entries for CVE-2026-61500 and CVE-2026-26980 in CISA’s catalog https://www.cisa.gov/known-exploited-vulnerabilities-catalog?ref=explainx . Anthropic has not published a point-by-point rebuttal to this VulnCheck post in the materials we fetched on November 11, 2026 . Watch its transparency pages and Mythos 5.2 security scans https://explainx.ai/blog/claude-mythos-5-security-scans-defender-advantage-fund-august-2026 for counter-metrics. Why public CVE math understates partner work — and why it still matters Glasswing’s public ledger is only the coordinated disclosure slice. Anthropic has repeatedly said Mythos-class partners scan proprietary stacks that may never become CVEs. That is real defender value, and HN commenters such as enthuseyourcurb argued corporate incidents will never appear in Garrity’s CSV. The tension is accountability . When Anthropic’s April launch quoted thousands of critical findings heading to open-source maintainers, policymakers and CISOs reasonably watched fix velocity on public code . Seven months later, 217 fixes on 37,966 ledger rows is a signal about operational scaling , even if private partner counts look better. For teams buying Claude Enterprise security scans , ask vendors for your metrics: true positive rate after human review , median days to merged fix , severity after maintainer downgrade , and duplicate rate against existing GHSA . Do not import ledger marketing KPIs into your SOC without that filter. Comparing offense models, Vals AI cyber range results https://explainx.ai/blog/vals-ai-cyberoffense-gpt-6-sol-daybreak-deepseek-v4-1-flash-open-weight-cyber-range-2026 show how gating shapes measured risk versus open weights. Glasswing’s structure keeps Mythos behind partners; OSS Scanner pushes ungated model output straight to inboxes. curl’s triage is the first visible quality control point on that new path. Related reading Ledger figures, curl triage counts, and KEV matches reflect VulnCheck’s November 9, 2026 post and linked maintainer blogs as of this article’s publication date.