Anthropic’s Glasswing reports 442 CVEs, but quality varies
Seven months into Project Glasswing, VulnCheck says it has tracked 442 CVEs attributed to Anthropic, with two listed as exploited in the wild. Anthropic’s ledger lists 37,966 findings and 217 fixes; VulnCheck says curl had rejected 19 of 34 reports published so far as not vulnerabilities. Anthropic says its broader Glasswing work also targets partners’ proprietary software, which is not covered by that open-source ledger.
Bottom line — The public ledger records 217 fixes, while Anthropic says Glasswing’s broader partner work includes proprietary systems.
Go deeper 7
-
VulnCheck says only 7,349 of Anthropic’s 37,966 ledger findings had been made public.
-
Since September, Anthropic added nearly 12,000 findings but recorded just 15 additional fixes, according to VulnCheck.
-
VulnCheck reports 1,654 findings marked as duplicates and 419 withdrawn.
-
Of 34 curl reports published so far, VulnCheck says six were confirmed as low severity and nine remained under assessment.
-
Anthropic says its OSS Scanner reports are model-generated without human review, and may be incorrect or invalid.
-
Anthropic says it committed up to €92 million ($100 million) in model credits and donated €3.7 million ($4 million) to open-source security organisations.
-
Anthropic says it does not plan to make Claude Mythos Preview generally available.