VulnCheck Report: Only 217 of Nearly 40,000 Candidate Vulnerabilities Discovered by Anthropic's Glasswing Are Publicly Fixed
Independent tracking by VulnCheck reveals a massive gap between AI-driven vulnerability discovery and actual remediation, highlighting a critical human review bottleneck.
Cybersecurity firm VulnCheck released a report in November 2026 independently tracking Anthropic's "Project Glasswing," an initiative designed to use Claude models to discover security vulnerabilities in open-source software at scale. The report indicates that seven months after the program's launch, Claude had identified 37,966 candidate vulnerabilities, yet only 217 were marked as fixed in public records as of early November.
This data contrasts with figures disclosed by Anthropic itself. According to official data from November 2, out of 37,966 candidate findings, 6,376 had been reviewed by external experts, 5,087 were reported to maintainers, and 629 received upstream patches. While differing statistical methodologies account for some discrepancies in the number of fixes, both parties acknowledge a core issue: the speed of AI-driven vulnerability discovery has created a severe bottleneck in human review capacity, significantly limiting disclosure and remediation efficiency.
To alleviate this pressure, Anthropic launched the OSS Scanner service on October 8, allowing open-source maintainers to receive model-generated vulnerability reports directly, bypassing Anthropic's internal human review process. However, this "zero human intervention" model shifts the validation burden to the community. For instance, Daniel Stenberg, maintainer of the curl tool, recently received 45 vulnerability reports from Anthropic. He stated that the core maintenance team was overwhelmed by the influx of reports and had to change rules to discuss low and medium severity vulnerabilities publicly on GitHub, leveraging community help for review.
VulnCheck's report notes that this gap is accelerating. In just the last two months, candidate vulnerabilities surged by nearly 12,000, while the record of fixed issues increased by only 15. Additionally, the 442 CVEs attributed to Anthropic tracked by VulnCheck represent only 0.5% of the global public CVE total for 2026. Although Anthropic did identify serious flaws like a Use-After-Free memory error in curl via Claude, the overall picture suggests that AI's powerful discovery capabilities have not translated into proportional remediation outcomes, instead imposing a heavy review workload on open-source maintainers.