# VulnCheck: 442 CVEs from Anthropic's Glasswing, two exploited

> Anthropic's AI vulnerability finder has produced 442 CVEs in seven months, and VulnCheck says maintainers absorb the triage cost.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research, Lab safety
- **Published by:** VulnCheck
- **Disclosed:** 2026-11-09
- **Affects:** Project Glasswing, Anthropic OSS Scanner, curl
- **Research by:** Patrick Garrity
- **Primary source:** https://www.vulncheck.com/blog/anthropic-glasswing-november-update
- **Page:** https://theinjection.dev/items/vulncheck-glasswing-seven-month-review/

VulnCheck counts 442 CVEs credited to Anthropic's Glasswing effort in seven months and says two are known to be exploited. Anthropic's ledger shows 217 findings fixed, against 1,654 duplicates and 419 withdrawn.

## What happened

Patrick Garrity of VulnCheck published a seven-month review of Project Glasswing, Anthropic's AI vulnerability-finding effort, on November 9, 2026. The review tracks 442 CVEs credited to Anthropic, about 63 a month, which Garrity puts at roughly 0.5% of the 93,450 CVEs published this year. VulnCheck lists two of those CVEs as known to be exploited.

## How it works

Glasswing findings reach maintainers through Anthropic's self-service OSS Scanner, which Anthropic says sends model-generated reports without human review. Triage therefore lands on the receiving project rather than on Anthropic. Garrity argues the published counts do not line up: Anthropic's disclosure ledger records 217 findings as fixed while listing 1,654 duplicates and 419 withdrawn entries.

## Who is affected

Open-source maintainers whose projects receive OSS Scanner reports carry the triage load, not Anthropic. curl is the worked example in the review, having received 45 reports, most of whose published entries were closed as not vulnerabilities. The per-project breakdown is in the table below.

## What to do

Follow curl's lead and publish low and medium severity AI-generated findings as public issues, which Garrity encourages so that the volume and accuracy of the reports stay visible. Treat a model-generated report as unreviewed until a human confirms it.

## Share of September ledger findings rated critical or high

Claude's own severity ratings against the maintainers' ratings of the same findings

| Result | Score |
|---|---|
| Rated by Claude | 91.5% |
| Rated by maintainers | 51.3% |

Source: https://www.vulncheck.com/blog/anthropic-glasswing-november-update

## Quick facts

- **CVEs credited:** 442 in seven months, about 63 a month
- **Known exploited:** 2 (CVE-2026-61500, CVE-2026-26980)
- **Ledger fixed:** 217
- **Ledger duplicates:** 1,654
- **Ledger withdrawn:** 419
- **curl reports:** 45 received, 34 published, 19 not a vulnerability, 6 confirmed low severity, 9 awaiting
- **Claimed true positive rate:** 94.2%, up from 90.8% at launch

## Questions

### Is Anthropic's Glasswing finding real vulnerabilities?

Glasswing has produced 442 CVEs credited to Anthropic in seven months, so a share of its findings are real and tracked. VulnCheck notes that only two of those CVEs are known to be exploited in the wild, and that Anthropic's own disclosure ledger lists 1,654 duplicates and 419 withdrawn entries alongside just 217 fixes.

### How accurate were the Glasswing reports curl received?

curl received 45 Glasswing reports and has published 34 of them. Of those, VulnCheck counts 19 marked not a vulnerability, 6 confirmed as low severity, and 9 still awaiting assessment. Garrity derives a 55.9% false positive rate from the published set, with 17.6% confirmed as genuine findings so far.

### What should an open-source maintainer do about AI-generated vulnerability reports?

Garrity recommends that maintainers copy curl and publish low and medium severity AI-generated findings as public issues. Publishing them makes the real volume and accuracy of the reports visible to everyone, rather than leaving each project to absorb the triage privately. Anthropic sends OSS Scanner reports without human review, so the receiving project does the filtering.

## Sources

1. [VulnCheck Review](https://www.vulncheck.com/blog/anthropic-glasswing-november-update)
2. [Anthropic Ledger](https://red.anthropic.com/2026/cvd/ledger/)
3. [OSS Scanner Post](https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source)
4. [Credited CVE Tracker](https://github.com/patrickmgarrity/Anthropic-Credited-CVEs)