Anthropic's Vulnerability Queue Keeps Growing

VulnCheck has tracked 442 CVEs attributable to Anthropic during the first seven months of Project Glasswing. Anthropic’s disclosure ledger is much larger: 37,966 reported findings, of which 7,349 have been made public and 217 marked fixed.

The difference between those numbers describes the central problem with AI-assisted vulnerability discovery. Producing candidate findings has become easier than validating, disclosing, and remediating them.

Since September, Anthropic added nearly 12,000 findings to its ledger while recording 15 additional fixes. The ledger also contains 1,654 findings marked as duplicates and 419 that were withdrawn. Duplicates alone outnumber fixes by roughly eight to one.

Those figures come from VulnCheck’s tracking of Project Glasswing, which combines CVE records, GitHub Security Advisories, Linux kernel commits, and Anthropic’s ledger. Anthropic updates that ledger in infrequent bulk batches, so VulnCheck also audits advisories manually.

The resulting picture is less about whether an AI model can find bugs. It can. The operational question is whether the surrounding security process can convert model output into validated vulnerabilities and shipped fixes.

Discovery has outrun validation

Anthropic said in October that it had found more than 29,000 candidate vulnerabilities and manually reviewed about 6,000. It described human validation capacity as the bottleneck. Nearly 5,000 unverified reports had already been sent in bulk to maintainers who requested them.

The OSS Scanner changes who handles that bottleneck. Projects can request scans, but the resulting reports are fully model-generated and receive no human review or triage from Anthropic. Maintainers must determine whether each report identifies a vulnerability, whether it duplicates existing work, how severe it is, and what remediation is appropriate.

That is expensive work. A scanner can produce another report at low marginal cost, while each report consumes scarce maintainer attention. As the queue grows, old findings can also become duplicates when somebody independently finds and fixes the same issue.

Anthropic’s reported true-positive rate increased from 90.8% when the ledger launched in May to 94.2% in its November 2 update. VulnCheck questions how that calculation treats duplicates and withdrawn reports. A useful quality metric needs an explicit denominator and stable outcome categories. Candidate findings, disclosed reports, validated vulnerabilities, duplicates, withdrawals, and fixes represent different stages of work and should not be combined into one favorable percentage.

curl provides a validation sample

The curl project received 45 reports from Anthropic. Anthropic rated one medium severity and the remainder low. Maintainer Daniel Stenberg moved them to GitHub gradually to limit the impact on the team.

Of the first 34 published reports, curl rejected 19 as vulnerabilities, confirmed six as low severity, and left nine awaiting assessment. On that incomplete sample, 55.9% had been rejected and 17.6% confirmed, with every confirmed report rated low severity.

The sample is limited to one project and assessment is still underway. It nevertheless shows why scanner-level accuracy claims cannot substitute for maintainer validation. In May, five earlier Mythos findings sent to curl resulted in one confirmed vulnerability.

Severity requires similar scrutiny. Model-assigned severity can help order a queue, but the affected project has the context needed to evaluate reachable code paths, realistic preconditions, and impact. Treating generated severity as established fact will distort both remediation priorities and reporting.

Exploitation data changes the priority

VulnCheck identified two of the 442 tracked CVEs as exploited in the wild: CVE-2026-61500 and CVE-2026-26980. That is 0.45% of the tracked set.

The low observed exploitation count does not erase the value of finding and fixing defects. It does make raw discovery volume a weak measure of security value. Operators need to know which findings are validated, applicable to deployed versions, reachable in their configurations, and associated with exploitation. A count of model-generated candidates answers none of those questions by itself.

Teams running AI-assisted vulnerability discovery should design the validation system before increasing scan volume. Reports need durable identifiers, deduplication across scan runs, clear ownership, and state transitions that distinguish generated, reviewed, disclosed, accepted, fixed, rejected, duplicated, and withdrawn findings. Accuracy and severity metrics should be recalculated from maintainer outcomes rather than frozen at generation time.

Rate limits also belong at the disclosure boundary. A project should be able to control batch size and intake cadence, particularly when reports have not received human review. Sending thousands of unverified findings may transfer more work than security value.

The most informative Glasswing numbers are therefore the conversion rates between stages. Anthropic’s ledger shows 37,966 findings, 7,349 public reports, and 217 fixes. Until validation and remediation capacity grow with discovery capacity, additional model output primarily enlarges the triage queue.

---

Contains a referral link.