442 CVEs, 2 Exploited: VulnCheck Audits Anthropic's Glasswing

VulnCheck counted 442 CVEs from Anthropic's Project Glasswing in seven months — and found exactly two exploited in the wild. That is an exploitation rate of 0.45%, according to the vulnerability intelligence firm's retrospective published this month.

Project Glasswing launched on April 7, 2026. Anthropic claimed at the time it had "identified thousands of additional high- and critical-severity vulnerabilities" destined for responsible disclosure to open source maintainers. VulnCheck began tracking attributable CVEs on April 17, drawing on CVE records, GHSAs, Linux kernel commits and Anthropic's own disclosure ledger.

What do the raw numbers show?

The 442 Glasswing-linked CVEs average 63 per month, set against 93,450 total CVEs published in 2026 — roughly 0.5% of the annual count. Anthropic's own ledger, updated November 2, lists only 217 fixed vulnerabilities, less than half the number VulnCheck tracked independently.

Two entries appear in VulnCheck's Known Exploited Vulnerabilities catalog: CVE-2026-61500 and CVE-2026-26980. As VulnCheck puts it, the receipts keep coming in; they still don't reconcile.

Why is the ledger under scrutiny?

Anthropic's public ledger shows 37,966 total findings as of November 2, up from 26,153 on September 8. Over that period:

• Findings made public rose from 2,736 (10.5%) to 7,349 (19.4%)
• Fixes increased by only 15
• 1,654 findings (4.4%) were marked duplicates — 7.5 times the number of fixes
• 419 findings were withdrawn
• The claimed true positive rate rose from 91.4% to 94.2%

VulnCheck also notes a bug: the ledger appears to inflate the "disclosed" count when filtered.

Who carries the triage burden now?

In its October 8 OSS Scanner launch post, Anthropic said it had found more than 29,000 candidate vulnerabilities but manually reviewed only about 6,000, remaining "bottlenecked on our human capacity to validate these findings." It had already sent nearly 5,000 unverified reports to maintainers who requested bulk delivery.

OSS Scanner reports are "fully model-generated, without human review or triage," Anthropic writes, and "it is possible reports will be incorrect or invalid."

curl maintainer Daniel Stenberg supplied a ground-truth check. Of 45 Anthropic reports received via OSS Scanner, he has published 34 so far: 19 were marked "not a vulnerability," six confirmed as low severity, and nine remain under assessment. That is a 55.9% false positive rate, with 17.6% confirmed — all low severity. Stenberg said he is pacing publication "to soften the impact for the team." In May, he wrote that five earlier "Mythos" findings for curl collapsed to a single confirmed vulnerability.

How accurate are Anthropic's claims?

Anthropic's ledger claims a 94.2% true positive rate. In September, VulnCheck found Claude rated 91.5% of ledger findings as critical or high, while maintainers rated only 51.3% that way.

Anthropic's own validation of 97 critical and high-severity OSS Scanner findings across 48 projects, reviewed by expert penetration testers, found 85 (88%) met its coordinated vulnerability disclosure bar; 11 were real but duplicated, and one was invalid. The company cites positive maintainer feedback from PostgreSQL, OpenSSL, wolfSSL, HotCRP and curl on early scanner output.

What does the academic evidence say?

A working paper by economist Thomas Mosk of Queen Mary University of London, posted to arXiv November 4, analyzed 13 large US firms granted early access to Claude Mythos Preview through Glasswing. Compared with Chinese firms barred from Anthropic models since September 2025:

• Monthly vulnerability disclosures rose about 120%
• High-impact flaws rose roughly 2.5x
• Median time from identifier reservation to publication fell from 75 days to 22
• Internally found vulnerabilities rose eightfold per firm per month
• The probability a Glasswing vulnerability was already exploited at disclosure fell about 70%
• Exploited-within-one-month rates dropped from 1.42% to 0.50%

Fixing speed did not slow: vendors processed Zero Day Initiative reports at least as fast, and Linux distributions shipped fixes after a median of one day.

Mosk lists caveats. Chinese firms could use domestic models such as DeepSeek V4 and GLM-5.2, so the comparison tests Mythos access versus other AI tools, not AI versus no AI. Chinese disclosure rules differ. The data show published and fixed flaws, not installed patches. With only 13 treated firms, the exploitation decline is "suggestive rather than established." And Anthropic's partners reported over 10,000 high and critical flaws in a month — far more than the roughly 470 extra monthly disclosures the estimates imply — suggesting many remain unfixed. The paper is a single-author working paper without peer review.

Seven months in, Glasswing has shifted the validation workload from Anthropic to open source maintainers, and the launch narrative of imminent risk has not matched observed exploitation. Whether the pipeline's volume converts into fixed, patched software — rather than maintainer inbox debt — is the question the next seven months will answer.