After 7 months, Glasswing overwelms maintainers with underwhelming findings

After seven months, Anthropic's Project Glasswing has identified 442 CVEs (roughly 0.5% of all CVEs published this year), but only 19.4% have been made public and just 217 have been marked fixed, raising questions about the project's claimed impact. The project has faced credibility issues, with maintainers rejecting many findings as vulnerabilities and Anthropic's true positive rate claims appearing inflated when accounting for duplicates and withdrawn findings. The gap between vulnerability discovery and remediation has widened significantly since September, with nearly 12,000 new findings added while only 15 additional fixes were recorded.