VulnCheck says Anthropic’s Project Glasswing has little to show after seven months: 217 fixes from 37,966 findings. Anthropic’s own dashboard supports part of that and complicates the rest. It counts 629 findings patched upstream, and it says the 37,966 are candidates that Claude produced before any review, of which 5,087 were reported to maintainers.
This page puts VulnCheck’s November 9 report next to Anthropic’s dashboard, its data file and the curl project’s public record. We read all three on November 11, 2026.
On this page · 8 sectionsOpen
VulnCheck’s November 9, 2026 report credits 442 CVEs to Anthropic after seven months of Project Glasswing, about 0.5% of the 93,450 CVEs published this year. Two are known to be exploited.
Anthropic’s dashboard, updated November 2, counts 37,966 candidates found by Claude. Outside firms reviewed 6,376 of them, and 5,087 were reported to maintainers.
The fix count depends on the page. Anthropic’s ledger marks 217 entries fixed, which is the number VulnCheck uses. Its dashboard counts 629 findings patched upstream.
The 94.2% true positive rate covers only the 6,376 findings that outside firms reviewed. The 3,225 reports sent directly to maintainers were not reviewed that way.
curl received 45 unreviewed reports on November 5. Its maintainer confirmed 7 as low severity vulnerabilities and classed 37 as ordinary bugs.
§ 01What VulnCheck reported
Patrick Garrity of VulnCheck, a vulnerability intelligence company, has tracked the program since April. His November 9 post makes five claims:
- CVEs: 442 CVEs can be credited to Anthropic, about 0.5% of the 93,450 CVEs published this year.
- Exploitation: two of the 442 are known to be exploited in the wild.
- Fixes: of 37,966 findings on Anthropic’s ledger, 7,349 are public and 217 are marked fixed.
- Duplicates: 1,654 findings are marked duplicate and 419 are withdrawn, more than the number fixed.
- Maintainers: the new OSS Scanner moves the checking to open-source maintainers, and the curl project rejected most of its first batch.
His conclusion is one line:
“They still don’t reconcile.”
He also says what he is not arguing:
“AI is a valuable tool for finding vulnerabilities, and I’m not discounting that.”
§ 02What Anthropic’s dashboard shows
Anthropic publishes a disclosure dashboard and a ledger for the program. Both were last updated on November 2, 2026 at 19:30 UTC, and they cover findings discovered since November 1, 2025.
| Stage | Findings | What Anthropic says it counts |
|---|---|---|
| Candidates | 37,966 | Every distinct crash or vulnerability hypothesis Claude produced, before any triage |
| Reviewed by outside security firms | 6,376 | Findings passed to one of six firms that reproduce each issue |
| Confirmed by those firms | 6,009 | The 94.2% true positive rate is this number over 6,376 |
| Reported to maintainers | 5,087 | 1,862 after outside review, 3,225 sent directly without it |
| Acknowledged by a maintainer | 3,635 | The maintainer has responded to the report |
| Patched upstream | 629 | A patch landed after the report was sent |
The dashboard also counts 733 advisories with an identifier assigned: 230 CVEs and 503 GitHub security advisories.
§ 03Where the two reads differ
The 37,966 are candidates, and most were never sent to anyone. VulnCheck calls them reported findings. Anthropic’s glossary defines them as every hypothesis Claude produced before triage. The number sent to maintainers is 5,087, which is 13.4% of the candidates. Anthropic says the limit is people, in its OSS Scanner announcement of October 8:
“we remain bottlenecked on our human capacity to validate these findings”
The fix count is 217 or 629, depending on the page. The ledger marks 217 entries fixed, and VulnCheck uses that number. The dashboard’s Patched upstream line reads 629. Against the 5,087 reports sent, 629 is 12.4%. Against all 37,966 candidates it is 1.7%.
The 7,349 public entries are mostly hashes. The ledger lists 7,349 entries, and each starts as a hash of a finding’s details. Anthropic’s data file marks 235 of them as revealed, with the project and bug class shown. By status, the same file holds 4,866 disclosed, 1,654 duplicate, 419 withdrawn, 217 fixed and 193 not yet disclosed.
The 94.2% is about one branch of the program. It is the share of the 6,376 outside-reviewed findings that the firms confirmed. Anthropic’s glossary says it includes duplicates and findings a maintainer will not fix, and its dashboard says the rate should be taken as only one proxy for impact. The 3,225 reports sent directly to maintainers were not reviewed this way, and the dashboard labels them as possibly containing false positives.
The duplicates are Anthropic’s own. VulnCheck’s table shows duplicates going from 2 in September to more than 1,600 in November. Anthropic’s About page explains the change in its November 2 update:
“We found that many reported findings were duplicates of our other findings.”
Between VulnCheck’s September 8 read and the November 2 update, the candidate count rose from 26,153 to 37,966. The ledger’s fixed count rose from 202 to 217.
§ 04The curl batch
curl is the one project where the unreviewed reports can be checked in public. Its maintainer, Daniel Stenberg, moved all low and medium severity reports into the open on October 26, and wrote of the volume of reports reaching the project:
“We must act to survive.”
On November 5 curl received 45 reports from Anthropic’s OSS Scanner. Anthropic rated one medium and 44 low. Stenberg posted them as GitHub issues over the next four days.
| Read | Assessed | Not a vulnerability | Confirmed low severity | Awaiting |
|---|---|---|---|---|
| VulnCheck, November 9 | 34 published | 19 | 6 | 9 |
| Daniel Stenberg, November 10 | 45 | 37 bugs and 1 false report | 7 | 0 |
| curl’s issue labels, November 11 | 45 | 37 | 7 | 1 |
Stenberg gave his own count on Mastodon on November 10:
“out of Anthropic’s latest 45 findings in #curl, we are at 7 confirmed LOW.”
Two details matter here. Seven confirmed out of 45 is 15.6%, and none is above low severity. And curl’s label for the other 37 means the issue is treated as an ordinary bug, so most of the batch was real defects that are not security problems. VulnCheck’s 55.9% false positive rate counts those as false.
§ 05Severity: Claude rates higher than maintainers
Anthropic’s data file pairs Claude’s severity rating with the maintainer’s for 176 findings. Claude rated 163 of them critical or high, which is 92.6%. Maintainers rated 100 of the same 176 critical or high, which is 56.8%. VulnCheck made the same comparison in September and found 91.5% against 51.3%.
§ 06What neither side has shown
- How accurate the 3,225 direct reports are. Anthropic publishes no rate for them. curl is one sample of 45.
- Whether two exploited CVEs is low. VulnCheck’s post gives no comparison rate for other reporters.
- What the 629 patches fixed. The dashboard does not break them down by severity in the counts above.
§ 07How we read it
Our conflict, declared: we build CellCog, and CellCog runs on Anthropic’s Claude models (Claude Opus 5.5 on most tiers; Claude Fable 5.2 on Agent Max and Creative Max since November 11, 2026). We had no part in this research.
Both sides are counting correctly and counting different things. VulnCheck counts what a defender can see: CVEs, fixes marked on the ledger, exploitation. Anthropic counts its pipeline, and most of that pipeline is still unreviewed candidates.
The honest headline number is small either way. Whether it is 217 or 629, patches are a small share of what the models flagged. Anthropic’s own dashboard calls patches the more reliable measure and a lagging one.
The cost has moved to maintainers. A model can produce a report in minutes. A person still has to reproduce it and decide. curl spent days on 45 reports to confirm seven low severity issues. That is the same lesson we take for any agent that files work for a human: the report is only worth what it costs the reader to check.
Our earlier pages cover the OSS Scanner launch and the program Glasswing was folded into.
§ 08Sources
- VulnCheck, After 7 months, Glasswing overwhelms maintainers with underwhelming findings, November 9, 2026
- Anthropic, coordinated vulnerability disclosure dashboard, ledger and About page, updated November 2, 2026
- Anthropic, OSS Scanner announcement, October 8, 2026
- Daniel Stenberg, Do minor curl vulnerabilities in the open, October 20, 2026, and his November 10 count
- curl, issues labelled by vulnerability assessment, read November 11, 2026
Q1What is Project Glasswing?
Anthropic’s program, launched on April 7, 2026, that uses Claude models, including Claude Mythos, to find security vulnerabilities in widely used open-source software and report them to maintainers.
Q2How many vulnerabilities has Project Glasswing fixed?
It depends on the count. As of November 2, 2026, Anthropic’s ledger marks 217 entries fixed, and its dashboard counts 629 findings patched upstream. Both come from 5,087 reports sent to maintainers and 37,966 candidates.
Q3What does the 94.2 percent true positive rate mean?
It is the share of 6,376 findings reviewed by outside security firms that those firms confirmed as real: 6,009. Anthropic says it includes duplicates and findings a maintainer will not fix. It does not cover the 3,225 reports sent without that review.
Q4What happened with curl and Anthropic's OSS Scanner?
curl received 45 reports on November 5, 2026, one rated medium and 44 low. By November 10 its maintainer, Daniel Stenberg, had confirmed 7 as low severity vulnerabilities, classed 37 as ordinary bugs and called one completely false.
Q5How many Glasswing CVEs have been exploited?
Two of the 442 CVEs that VulnCheck credits to Anthropic appear on VulnCheck’s list of vulnerabilities exploited in the wild, as of its November 9, 2026 post.
Q6Does CellCog take part in Project Glasswing?
We had no part in this research. CellCog runs on Anthropic’s Claude models, which is why we follow how Anthropic’s security programs perform.