VulnCheck audit: Anthropic's Project Glasswing logged 37,966 findings, only 217 fixed
GaryMarcus · x · 2026-11-12
VulnCheck published a 7-month audit of Anthropic's Project Glasswing (launched April 7 to mass-disclose open source vulnerabilities), which Gary Marcus shared while questioning whether it's "mostly just a marketing thing."
Key data:
- Of 37,966 reported findings, only 19.4% (7,349) were made public and just 217 marked fixed;
- 442 CVEs are attributable to Anthropic (0.5% of all CVEs this year), with only 2 exploited in the wild;
- Since September, 12,000 findings added but only 15 additional fixes, widening the discovery-remediation gap;
- 1,654 findings (4.4%) marked duplicates — nearly 8x the number fixed — plus 419 withdrawn;
- Anthropic's claimed true positive rate rose from 90.8% to 94.2%, but accounting for duplicates/withdrawals is questionable; curl rejected 19 of 34 published reports;
- Conclusion: the OSS Scanner shifts validation work onto maintainers, and output falls far short of the project's hype.
Related event: Glasswing Report: 38,000 Vulnerabilities Found, Only 217 Fixed(3 posts)→
More from Companies & People
- Rox raises $270M Series B at $1.3B valuation, 12 months after launch — Konstantine · 2026-11-12
- United Airlines bans personal AI assistants from booking flights, citing privacy and FAA concerns — julianweisser · 2026-11-12
- Mistral AI philosopher Giada Pistilli to debate AI companions with UPC students — GiadaPistilli · 2026-11-12
- VC: 'Age of Miracles' beats doom talk as the more effective IPO marketing pitch — firstadopter · 2026-11-12
- Zhang Yiming reportedly told ByteDance to build AGI without distillation, admitting it won't catch OpenAI until 2029-30 — kevinsxu · 2026-11-12
- PM lists 8 AI uses that replaced his daily workflow — "I barely have to type anymore" — bibryam · 2026-11-12