AI Research
21h ago
Anthropic's Project Glasswing Reports Limited Vulnerabilities After Seven Months
Nov 10, 2026
AI Summary
Anthropic's Project Glasswing has identified 442 vulnerabilities in seven months, but only a small fraction are deemed useful. The project's findings have raised concerns about the accuracy and effectiveness of its vulnerability disclosures, with many reports marked as duplicates or withdrawn.
- Anthropic launched Project Glasswing on April 7, claiming to identify thousands of vulnerabilities.
- After seven months, 442 vulnerabilities have been tracked, averaging 63 per month, representing only 0.5% of all CVEs published this year.
- Anthropic's public ledger lists 217 fixed vulnerabilities, which is less than half of what has been tracked independently.
- Only 2 out of 442 tracked vulnerabilities have been exploited in the wild, indicating low real-world impact.
- The number of findings reported by Anthropic increased to 37,966, but only 7,349 (19.4%) have been made public, with 1,654 marked as duplicates.
- A significant number of findings have been withdrawn, raising questions about the claimed true positive rate of 94.2%.
- The project has shifted the burden of triaging findings to open source maintainers, who are now tasked with validating reports that are largely generated by AI without human review.
- In a recent batch of 45 vulnerability reports received by the curl project, 55.9% were marked as not vulnerabilities, highlighting a high false positive rate.
- The effectiveness of the Glasswing initiative is under scrutiny, as the actual outcomes do not align with the initial claims made at its launch.
glasswinganthropicfindingsresearchupdates