Anthropic's Glasswing Project Faces Criticism Over Low Fix Rates and High False Positives

Seven months into Anthropic’s Project Glasswing, only 0.5% of this year’s CVEs (442 total) are attributed to the initiative, with just two exploited in the wild. Of 37,966 reported findings, only 217 have been fixed, while 1,654 are marked duplicates and 419 withdrawn. The claimed true positive rate has risen to 94.2%, but this figure appears inconsistent with the high volume of duplicates and withdrawn findings. Anthropic’s OSS Scanner, which shifts validation to maintainers, has faced scrutiny after 19 of 34 vulnerability reports were rejected by curl, with 55.9% classified as false positives. This highlights a significant gap between Anthropic’s claims and the actual validation outcomes by maintainers, raising questions about the tool’s accuracy and the burden placed on open-source teams. The project’s progress has been slow, with nearly 12,000 new findings added since September but only 15 additional fixes recorded.