Seven months into Anthropic’s Project Glasswing, VulnCheck has tracked 442 attributed CVEs—only about 0.5% of the total CVEs published this year—with just two exploited in the wild and a low remediation rate of 217 fixes out of nearly 38,000 findings. The project’s vulnerability reporting has shifted much of the triage burden onto open source maintainers, exemplified by curl rejecting over half of Anthropic’s OSS Scanner reports as false positives or low severity, casting doubt on the claimed 94.2% true positive rate and the project’s overall effectiveness in identifying critical, actionable vulnerabilities.
https://www.vulncheck.com/blog/anthropic-glasswing-november-update