Anthropic Glasswing at 5 months: 26,153 findings, only 0.8% fixed so far
terryyuezhuo · x · 2026-09-09
VulnCheck's Patrick Garrity audits Anthropic's Project Glasswing (launched April 7) via its Vulnerability Disclosure Ledger: Anthropic claims 26,153 findings, but only 2,736 (10.5%) reached the public ledger; just 202 (0.8%) are confirmed fixed, 245 (0.9%) withdrawn, and 2,096 (8%) reported to maintainers without confirmed fixes. Five months in, only 9.8% of findings have reached a maintainer — highlighting that validating, coordinating and fixing vulnerabilities still requires human triage, a limitation Anthropic itself acknowledges.
More from Safety
- AI shrinks the patch window to hours; air-gapped backups are your last line — aakashgupta · 2026-10-26
- NYT roundtable asks five experts what the rules for AI companies should actually be — ShakeelHashim · 2026-10-26
- Google DeepMind pilots world's first double-blind evaluations for frontier models — scychan_brains · 2026-10-26
- LLM back-of-envelope estimate puts PHP vulnerability impact at $1bn–$4bn — S_OhEigeartaigh · 2026-10-26
- US states halt new data centers as 72% of Americans oppose local builds — YvesMulkers · 2026-10-26
- LEMON: zero-shot LLM misbehavior monitor flags hallucinations from attention maps — yoavartzi · 2026-10-26