Claude found 37,966 vulnerabilities but only 217 fixed, drowning open source maintainers
量子位 · wechat · 2026-11-11
VulnCheck's seven-month report on Anthropic's Project Glasswing shows Claude has surfaced 37,966 candidate vulnerabilities, yet only 217 are publicly recorded as fixed. In the last two months candidates grew by nearly 12,000 while fixes rose by just 15.
- Anthropic's own numbers: 6,376 candidates externally reviewed, 6,009 valid, 5,087 reported to maintainers, 629 patched upstream
- Both sides agree human review is the bottleneck; Anthropic launched OSSScanner letting maintainers receive Claude's reports directly
- curl's Daniel Stenberg, hit with 45 reports at once, moved low/medium severity issues to public GitHub discussion; 19 of 34 published reports weren't actual vulnerabilities
- Claude did find one of curl's most severe bugs in years: a use-after-free that could enable remote code execution
- Generating AI patches is easy; getting them accepted isn't — reviewing one can cost as much as rewriting, and "AI is good at adding things but doesn't realize things can be removed"
Related event: Glasswing Report: 38,000 Vulnerabilities Found, Only 217 Fixed(3 posts)→
More from Models
- The Zvi opens reaction thread on Gemini 4 Carbon: is it worth extended coverage? — TheZvi · 2026-11-12
- Walden Robotics' Sage model quadruples robot uptime on Toyota factory lines — adnothing · 2026-11-12
- Gemini won't let you keep chat history while opting out of AI training — Google bundles both into one setting — arshdeep · 2026-11-12
- Gemini 4 Carbon Flex tier now costs the same per token as GPT 6.1 Terra — mariofilhoml · 2026-11-12
- Real-world test: Kimi K3.1 Pro costs 5.4x less than Opus 5.5 per task despite 2x list-price gap — Arindam_1729 · 2026-11-12
- Claude Fable 5.2 tops Agent Arena at +30.4%, 1.5x the gain of runner-up Opus 5.5 — daniel_mac8 · 2026-11-12