Seven months of Project Glasswing: 37,966 findings, 217 marked fixed, and curl rejected 19 of 34 reports

On November 9, VulnCheck researcher Patrick Garrity published his fourth audit of Project Glasswing, Anthropic’s program for finding vulnerabilities in widely used software with Claude Mythos and disclosing them to maintainers. Seven months after the April 7 launch, Anthropic’s public ledger lists 37,966 findings, of which 217 are marked fixed. Garrity’s own tally attributes 442 published CVEs to Anthropic, and two of them appear in VulnCheck’s catalog of vulnerabilities exploited in the wild.

The audit does not dispute that the models find real bugs. Its argument is about throughput: the discovery side of the pipeline has scaled by tens of thousands of findings, and the validation, disclosure and patching side has barely moved. That gap now lands on open source maintainers.

The ledger, eight weeks apart

Garrity compared Anthropic’s ledger as of September 8 with the November 2 update:

Metric	Sept 8	Nov 2	Change
Total findings	26,153	37,966	+11,813
Made public	2,736 (10.5%)	7,349 (19.4%)	+4,613
Fixed	202	217	+15
Withdrawn	245	419	+174
Duplicates	2	1,670	+1,668
Claimed true-positive rate	91.4%	94.2%	+2.8 pts

The ratio is what stands out. For each finding newly marked fixed in those eight weeks, about 790 were added and about 110 were marked duplicate. Duplicates are a cost of running many scans over the same code: the same bug gets reported again, and someone has to recognize it. The post’s text gives 1,654 duplicates and its table 1,670; either way the count is roughly 7.5 times the number of fixes.

Garrity also flags that the 94.2% accuracy figure rose while withdrawals and duplicates climbed, and suspects the rate does not count either against the model. That is his inference; Anthropic has not published how the rate is calculated. He notes an apparent bug in the ledger that inflates the “disclosed” count, and that the ledger updates in irregular batches, so recent numbers may lag reality. The post carries no response from Anthropic.

The “fixed” figure deserves the same caution in the other direction. Garrity counts 442 CVEs from CVE records, GitHub advisories and Linux kernel commits, more than twice the ledger’s 217 fixes. Since a CVE usually ships with a patch, the ledger is undercounting fixes, and the real stall is smaller than 15 in eight weeks implies. The tracking repository is public.

442 CVEs in context

Those 442 CVEs work out to about 63 a month and roughly 0.5% of the 93,450 CVEs published in 2026. Two, CVE-2026-61500 and CVE-2026-26980, are in VulnCheck KEV, a rate of 0.45%.

Low exploitation cuts both ways. A bug found and patched by a defender before attackers notice is the outcome the program exists to produce, so few exploited CVEs is not evidence of low value. But it does bear on the launch claim. Anthropic said in April that it had identified “thousands of additional high- and critical-severity vulnerabilities”. Seven months later the public record contains a few hundred CVEs, and when Garrity compared severity ratings in September, Claude had rated 91.5% of ledger findings critical or high while maintainers rated 51.3% that way. The site covered the original claims when Mythos Preview was reported to have found zero-days in every major operating system; the question since has been how many of those findings survive a maintainer’s review.

What curl’s batch looked like

The one project-level dataset in the audit comes from curl. Maintainer Daniel Stenberg received 45 reports from Anthropic, one rated medium and the rest low, and is publishing them gradually “to soften the impact for the team”. Of the 34 published so far:

• 19 (55.9%) were judged not a vulnerability
• 6 (17.6%) were confirmed, all low severity
• 9 are still being assessed

If every open report turns out valid, the hit rate would be 15 of 34, or 44%. Stenberg wrote in May that five earlier Mythos findings came down to one confirmed vulnerability.

Curl is a hard target. It is about as heavily fuzzed and audited as C code gets, and Stenberg has been publicly strict about AI-generated reports for years. A 56% rejection rate there does not transfer to a typical npm package. It is still a useful calibration point against a 94.2% true-positive claim, because it is the only place where an outside party has published its verdicts report by report. Garrity encourages other projects to publish low and medium findings the same way.

The OSS Scanner moves triage downstream

The pressure on maintainers increased on October 8, when Anthropic launched its OSS Scanner. According to the figures VulnCheck quotes from Anthropic, the scanner produced more than 29,000 candidate vulnerabilities, about 6,000 were manually reviewed, and nearly 5,000 unverified reports were sent to maintainers in bulk. Anthropic described itself as “bottlenecked on our human capacity to validate these findings”, and says reports from the self-service version are “fully model-generated, without human review or triage”.

That changes who does the work. An unverified report costs the sender almost nothing and costs the recipient a reproduction attempt, often by a volunteer. The Cloud Security Alliance summarized the same figures in its November 10 briefing. The short version: finding has been automated and fixing has not.

The same pattern shows up from the other labs. OpenAI’s cyber program reported hundreds of Linux privilege-escalation exploits earlier this month, and Anthropic’s own Mythos 5.2 release on November 9 claimed the model rediscovers 89.6% of a set of 1,829 known CVEs from pre-fix code. Finding capacity is rising with each model generation. Patch capacity is still people.

What maintainers and security teams can take from this

VulnCheck sells vulnerability intelligence and the post ends with a product pitch, so the framing is adversarial. The underlying numbers are Anthropic’s own ledger and public CVE records, and they support a few practical conclusions.

• Do not treat a model-assigned severity as a triage input. On the available evidence it runs about 40 points higher than maintainer ratings.
• Ask for a reproducer. If you maintain a project receiving bulk AI reports, a working proof of concept is the cheapest filter, and requiring one is reasonable policy.
• Publish dispositions. Curl’s public verdicts are the only independent accuracy data anyone has. More projects doing it would settle the true-positive argument faster than any vendor blog.
• For defenders, prioritize by exploitation, not by source. Two of 442 in a KEV list means “found by Mythos” is not a reason to jump a patch queue.

The next ledger update will show whether fixes start tracking findings or the gap keeps widening. Also worth watching: whether Anthropic documents how its true-positive rate handles duplicates and withdrawals, whether it adds validation capacity or pays maintainers to triage, and what the remaining 11 curl reports look like once Stenberg publishes them.