VulnCheck Counts 442 Glasswing CVEs, Two Exploited, and a Ledger That Contradicts Itself

VulnCheck counts 442 CVEs attributable to Anthropic's Project Glasswing, about 0.5 percent of the 93,450 CVEs published in 2026, and two of them are exploited in the wild. The count comes from Patrick Garrity at VulnCheck, a vulnerability-intelligence vendor, in a post titled "After 7-months, Glasswing Overwelms Maintainers with Underwhelming Findings". It had 389 points on Hacker News when this was filed.

The claim to test is the post's conclusion, which Garrity phrased this way: "I don't know how anyone can read these numbers as anything but damning." The numbers support a narrower statement than that, and a different one from Anthropic's.

What the ledger shows

Anthropic publishes a disclosure ledger, a running list of the findings its models have produced. VulnCheck reproduces the figures from its Nov. 2 update next to the Sept. 8 ones.

Ledger figure	Sept. 8	Nov. 2
Total findings	26,153	37,966
Made public	2,736	7,349
Fixed	202	217
Withdrawn	245	419
Duplicates	2	1,670

The total grew by 11,813 in eight weeks and fixes grew by 15. The duplicates column went from 2 to 1,670, a jump the post says is unexplained. The post's takeaways give 1,654 duplicates, 4.4 percent, while its table gives 1,670, and it does not reconcile the two.

1. Duplicates1670 findings
2. Withdrawn419 findings
3. Fixed217 findings

Source: VulnCheck, Nov. 9, 2026

The chart leaves out the 37,966 total and the 7,349 made public because they would flatten everything else. Garrity also counts CVEs, which is why 442 is more than twice the ledger's 217 fixes. His count depends on his own method of linking CVEs to Anthropic, including manual judgment, and he says the ledger may overstate how many findings were disclosed.

What maintainers say

The strongest evidence in the post is a single project. Daniel Stenberg, who maintains curl, received 45 reports from Anthropic, which rated one medium and the rest low. Of 34 published so far, 19 were not vulnerabilities, a 55.9 percent false-positive rate. Six were confirmed low severity and nine await assessment. In May, five Mythos findings reduced to one confirmed vulnerability.

Severity is the other gap. Garrity's September analysis found Claude rated 91.5 percent of ledger findings critical or high, while maintainers rated 51.3 percent that way. Anthropic's own May 22 update says its severity figures use Claude's estimate for direct disclosures and maintainers' or partners' judgment where available.

Both figures carry a caveat. The curl rate covers only 34 of the 45 reports, with nine pending, and the severity comparison comes from VulnCheck's own September analysis.

The counter-case

Other maintainers describe a different experience. InfoQ's Oct. 23 report on Anthropic's OSS Scanner quotes wolfSSL's Todd Ouska: "of the 74 reports we received, all but two were valid, and five became CVEs." PostgreSQL's Noah Misch said several reports came with fixes the project could use nearly as-is. In a test of an early scanner version, 85 of 97 assessed critical and high findings met Anthropic's disclosure criteria, 11 were real duplicates and one was invalid. InfoQ calls that a selected sample, not an accuracy rate.

Stenberg himself credited the scanner with an HTTP/2 use-after-free fixed in curl 8.23.0 as CVE-2026-92392, rated high rather than critical.

The scanner changes the volume, not just the tone. InfoQ reports that over six months Anthropic's models flagged more than 29,000 candidate vulnerabilities, that researchers manually reviewed about 6,000, and that maintainers who asked for early access received nearly 5,000 unverified reports with proposed patches. Unvalidated findings carry no automatic 90-day disclosure deadline; the clock starts only when a maintainer validates a report and Anthropic is notified.

Anthropic's own framing is a capacity problem. Its May update said the "bottleneck in fixing bugs like these is the human capacity to triage, report, and design and deploy patches for them," and that some maintainers had asked it to slow disclosures. Its October scanner post, as VulnCheck quotes it, describes reports as "fully model-generated, without human review or triage." Anthropic's May figures were 23,019 findings and a 90.6 percent valid rate on 1,752 assessed high and critical findings, against VulnCheck's 90.8 percent at launch. The post and the source disagree by 0.2 points and do not explain why.

What would settle it

Two missing baselines limit both sides. The post gives no exploitation rate for CVEs in general, so 2 of 442, or 0.45 percent, has nothing to be compared with. The two exploited CVEs are CVE-2026-61500 and CVE-2026-26980, per VulnCheck's own exploited-vulnerability list, and VulnCheck sells such data. The post includes no Anthropic response.

The test is the fixed column. Anthropic said in May that 75 of 530 disclosed high and critical bugs were patched and that it was early in a 90-day window. Fixes were 217 on Nov. 2, and the next ledger update will show whether that moves with the 7,349 made public. The Terminal's piece on Git's draft vote on AI-looking patches covers the other side of the same load, maintainers deciding what to accept.

For how a model-assisted find becomes an exploit chain, see Hacktron's libheif and SSO chain.