Anthropic's Project Glasswing Finds Many Vulnerabilities but Fixes Very Few After Seven Months
Anthropic's flagship AI-powered vulnerability discovery initiative, Project Glasswing, has identified nearly 38,000 potential vulnerabilities in the last seven months, but less than 0.5% have been fixed publicly. Researcher Patrick Garrity from VulnCheck's November 9 report highlights that out of 37,966 claimed findings, only 5276 have been validated as unique and real, and just 217 have been remediated. The project faces challenges in triaging and validating findings due to limited human capacity, prompting Anthropic to launch an OSS Scanner tool that lets open source maintainers triage results themselves. Feedback from maintainers such as Daniel Stenberg reveals many AI-flagged vulnerabilities are false positives or low severity, exacerbating maintainers' workload and bringing into question the effectiveness and true positive rate of the project’s vulnerability reports. Anthropic has not commented on these concerns as of publication.
Linha do tempo
-
Anthropic's Project Glasswing Finds Many Vulnerabilities but Fixes Very Few After Seven Months
ler a análise desta fonte ocultar
Anthropic's flagship AI-powered vulnerability discovery initiative, Project Glasswing, has identified nearly 38,000 potential vulnerabilities in the last seven months, but less than 0.5% have been fixed publicly. Researcher Patrick Garrity from VulnCheck's November 9 report highlights that out of 37,966 claimed findings, only 5276 have been validated as unique and real, and just 217 have been remediated. The project faces challenges in triaging and validating findings due to limited human capacity, prompting Anthropic to launch an OSS Scanner tool that lets open source maintainers triage results themselves. Feedback from maintainers such as Daniel Stenberg reveals many AI-flagged vulnerabilities are false positives or low severity, exacerbating maintainers' workload and bringing into question the effectiveness and true positive rate of the project’s vulnerability reports. Anthropic has not commented on these concerns as of publication.