Glasswing: 37,966 Claude Findings, Only 217 Marked Fixed

Seven months after Anthropic launched Project Glasswing, the security firm VulnCheck has published a November update that questions the results. According to VulnCheck, Anthropic's public disclosure ledger listed 37,966 candidate vulnerabilities on 2 November 2026, yet only 217 of them were marked as fixed. The Chinese outlet QbitAI relayed the report on 12 November 2026.

Project Glasswing is an Anthropic programme launched on 7 April 2026 that uses Claude models to find security flaws in critical software and open source projects, then discloses them to the maintainers. A ‘candidate vulnerability’, also called a finding, is a bug report generated by the model that has not necessarily been confirmed by a human or by the project's maintainers. A CVE is the public identifier given to a confirmed vulnerability.

What do the Glasswing numbers actually show?

• 37,966 findings in Anthropic's ledger on 2 November, up from 23,019 when the ledger launched in May, according to VulnCheck.
• Only 7,349 findings (19.4%) have been made public, and 217 are marked fixed, according to VulnCheck.
• 1,654 findings (4.4%) are marked as duplicates, about 7.5 times more than the fixes, and 419 have been withdrawn, according to VulnCheck.
• Since September, Anthropic added nearly 12,000 findings but recorded only 15 additional fixes, according to VulnCheck.
• VulnCheck tracks 442 CVEs attributable to Anthropic, about 0.5% of the 93,450 CVEs published in 2026, and only 2 of them (0.45%) appear in its catalogue of vulnerabilities exploited in the wild.

VulnCheck's own count of 442 CVEs is more than twice the 217 fixes listed by Anthropic, because VulnCheck also counts CVE records, GitHub advisories and Linux kernel commits credited to Anthropic, not only the ledger.

What does Anthropic say about its own figures?

According to QbitAI, which cites Anthropic's own disclosure data, 6,376 of the 37,966 findings had been reviewed by external security experts as of 2 November. Of these, 6,009 were judged valid, 5,087 had been reported to software maintainers and 629 had received an upstream patch. QbitAI notes that the counting methods differ, which explains why Anthropic's 629 patches do not match VulnCheck's 217 fixes.

VulnCheck also questions the claimed true positive rate, which rose from 90.8% to 94.2% even though more findings were withdrawn or marked as duplicates than fixed. The firm suspects that triage rates are being counted as true positives.

Anthropic itself acknowledges the bottleneck. In the launch post of its OSS Scanner on 8 October, quoted by VulnCheck, the company said it had found more than 29,000 candidates but manually reviewed only about 6,000, and that it remained ‘bottlenecked on our human capacity to validate these findings’. VulnCheck adds that nearly 5,000 unverified reports had already been sent to maintainers who asked for everything in bulk.

Why are open source maintainers under pressure?

OSS Scanner lets open source maintainers request a free scan of their code and triage the results themselves. Anthropic describes these reports, according to VulnCheck, as ‘fully model-generated, without human review or triage’ and warns they may be incorrect. VulnCheck concludes that the triage bottleneck did not disappear but moved to the maintainers.

The curl project gives a concrete example. VulnCheck reports that curl maintainer Daniel Stenberg announced a batch of 45 reports from Anthropic in early November, of which Anthropic rated only one as medium severity and the rest as low. Of the 34 reports published so far, 19 were judged not to be vulnerabilities, 6 were confirmed as low severity and 9 were still awaiting assessment, which VulnCheck computes as a 55.9% false positive rate at this stage.

According to QbitAI, Stenberg changed curl's handling rules so that low and medium severity reports are discussed publicly on GitHub, letting more community developers help review them. QbitAI also recalls that in September Claude helped uncover a serious use-after-free memory bug in curl, which Stenberg described as one of the most serious curl vulnerabilities in years. In another check, VulnCheck found in September that Claude rated 91.5% of ledger findings as critical or high, while maintainers rated only 51.3% that way.

Can the VulnCheck report be taken at face value?

Not entirely. QbitAI points out that VulnCheck sells vulnerability intelligence and prioritisation services, which match the very problems the report criticises. VulnCheck itself writes that AI is an effective tool for finding vulnerabilities and that it is not discounting this. It also says Anthropic's ledger is updated only in infrequent bulk batches and appears to contain a bug that inflates the number of findings shown as disclosed.

Anthropic's response to the VulnCheck report does not appear in the two sources we read, so it remains unknown. The question of automatic fixes is also open: QbitAI says Anthropic already generates candidate patches, but developers cited by the outlet say reviewing an AI patch can take almost as long as writing it, and that such patches may add complexity.

What it changes for a company

For a company that depends on open source components such as curl, the number of findings announced by an AI vendor is not the number of risks to fix. Ask suppliers how many findings are confirmed, how many are fixed and in which version, rather than relying on candidate counts. Prioritise patching with exploitation data, since only 2 of the 442 tracked CVEs are known to be exploited in the wild according to VulnCheck. If your team maintains open source code, plan human time to triage AI-generated reports before accepting a free scan.