Anthropic Glasswing at 5 months: 26,153 findings, only 0.8% fixed so far
terryyuezhuo · x · 2026-09-09
VulnCheck's Patrick Garrity audits Anthropic's Project Glasswing (launched April 7) via its Vulnerability Disclosure Ledger: Anthropic claims 26,153 findings, but only 2,736 (10.5%) reached the public ledger; just 202 (0.8%) are confirmed fixed, 245 (0.9%) withdrawn, and 2,096 (8%) reported to maintainers without confirmed fixes. Five months in, only 9.8% of findings have reached a maintainer — highlighting that validating, coordinating and fixing vulnerabilities still requires human triage, a limitation Anthropic itself acknowledges.
More from Safety
- PHP2Shell exploits confirmed in the wild, attackers may use agentic AI for post-exploitation — AravSrinivas · 2026-10-27
- php2shell exploit benchmark: only 2 of 5 frontier models can port the bug — xeophon · 2026-10-27
- Interactive 32-slide AI security & privacy lecture for lawyers, now public — chrisrohlf · 2026-10-27
- Two CVSS 9.9 Wasmtime flaws allow sandbox escape, one ARM64-only since 2020 — basedjensen · 2026-10-27
- Free prepare.aiendgame.com site guides users through locking down accounts amid AI cyberstorm — harris_edouard · 2026-10-27
- Cisco routers trust eMudhra CAs whose private keys were numbers under 256 — murat_kocaoglu_ · 2026-10-27