Seven Months Into Project Glasswing, Anthropic Reports 37,966 Findings but Just 217 Fixes

VulnCheck tracked 442 CVEs attributed to Anthropic, with two listed as exploited in the wild. Anthropic’s ledger reports 37,966 findings, but only 7,349 are public and 217 are marked fixed; since September, findings rose by nearly 12,000 while fixes increased by 15. In curl’s initial review of 34 OSS Scanner reports, maintainers rejected 19 as vulnerabilities, confirmed six as low severity, and left nine pending.

The OSS Scanner can give projects access to vulnerability reports, but its reports are model-generated and unreviewed, so maintainers must absorb the validation work. curl’s early results suggest teams may need capacity to triage a large volume of low-value or invalid reports; the evidence is limited to 34 assessed reports, with nine still awaiting review, and does not establish how results compare across projects.