Anthropic's Project Glasswing flags ~38,000 potential vulnerabilities in seven months, but only 217 confirmed fixed
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 12/11/2026 12:04; os links antigos trazem para cá.
Anthropic's AI-driven vulnerability discovery initiative, Project Glasswing, has produced nearly 38,000 claimed vulnerability findings since April 2026, but remediation is lagging far behind. A VulnCheck report of November 9 by researcher Patrick Garrity says that of 37,966 claimed findings, only 5,276 have been validated as unique and real, and just 217 have been remediated, so under 0.5% have been fixed publicly (infosecurity-magazine.com). Disclosure is also limited, with under 20% of findings publicly disclosed and only a small fraction marked as fixed (digit.fyi). Open source maintainers such as Daniel Stenberg of curl report that many AI-flagged issues are false positives or low severity, which adds to their triage workload (infosecurity-magazine.com, digit.fyi). Anthropic has launched an opt-in OSS Scanner service so maintainers can triage results themselves, and acknowledges that human capacity is the limiting factor. Anthropic had not commented on the criticism at the time of the first report (infosecurity-magazine.com).
Detalhes técnicos
- Claimed findings: 37,966. Validated as unique and real: 5,276. Remediated: 217 (infosecurity-magazine.com, citing VulnCheck).
- The backlog of AI-generated reports particularly affects open source projects such as curl, which struggle to validate and prioritize findings (digit.fyi).
- A large volume of duplicates and withdrawn reports raises concerns about accuracy and practical utility (digit.fyi).
- The sources do not name specific CVEs, affected products or severity breakdowns.
Remediação
- Anthropic's OSS Scanner is an opt-in service that lets open source maintainers triage Glasswing results themselves, intended to speed up disclosure (infosecurity-magazine.com, digit.fyi).
- Maintainers should expect a high volume of reports and prioritize validated, unique findings, since many flagged issues are false positives, duplicates or low severity.
Relatos divergentes
- True-positive rate: digit.fyi says Anthropic reports a high true-positive rate in reviewed samples, while infosecurity-magazine.com cites maintainer feedback (Daniel Stenberg) that many findings are false positives or low severity, and reports that Anthropic had not commented. The two are not directly reconcilable: Anthropic's figure applies to reviewed samples, and the maintainer reports are anecdotal.
- Disclosure and fix figures: infosecurity-magazine.com states that less than 0.5% of findings have been fixed publicly, while digit.fyi states that under 20% have been publicly disclosed with only a small fraction marked as fixed. These measure different things (fixed versus disclosed) and are not strictly contradictory. The VulnCheck figures of 217 fixed out of 37,966 are the most specific available. digit.fyi is the more recent report (November 12).
Linha do tempo
-
Anthropic's Project Glasswing Identifies Tens of Thousands of Vulnerabilities but Struggles with Effective Remediation
ler a análise desta fonte ocultar
Anthropic's AI-driven security initiative, Project Glasswing, has identified nearly 38,000 potential software vulnerabilities since April 2026. However, remediation progress has been slow, with under 20% of findings publicly disclosed and only a small fraction marked as fixed. Research highlights a growing backlog of AI-generated vulnerability reports, particularly affecting open-source projects like curl, which face challenges in validating and prioritizing findings. While Anthropic reports a high true-positive rate in reviewed samples, the large volume of duplicates and withdrawn reports raise concerns about the accuracy and practical utility of the AI outputs. The company has introduced an opt-in OSS scanning service aimed at accelerating disclosure but acknowledges human capacity remains a limiting factor. This case illustrates the broader cybersecurity industry challenge of balancing rapid AI vulnerability discovery with effective verification and remediation processes.
-
Anthropic's Project Glasswing Finds Many Vulnerabilities but Fixes Very Few After Seven Months
ler a análise desta fonte ocultar
Anthropic's flagship AI-powered vulnerability discovery initiative, Project Glasswing, has identified nearly 38,000 potential vulnerabilities in the last seven months, but less than 0.5% have been fixed publicly. Researcher Patrick Garrity from VulnCheck's November 9 report highlights that out of 37,966 claimed findings, only 5276 have been validated as unique and real, and just 217 have been remediated. The project faces challenges in triaging and validating findings due to limited human capacity, prompting Anthropic to launch an OSS Scanner tool that lets open source maintainers triage results themselves. Feedback from maintainers such as Daniel Stenberg reveals many AI-flagged vulnerabilities are false positives or low severity, exacerbating maintainers' workload and bringing into question the effectiveness and true positive rate of the project’s vulnerability reports. Anthropic has not commented on these concerns as of publication.