I keep a tab open on Anthropic’s vulnerability disclosure ledger the way I keep one on a build dashboard. Not because the number is heading anywhere good, but because the distance between the two columns is the story.
This week Patrick Garrity published a seven month audit of Project Glasswing at VulnCheck that puts those columns side by side. Glasswing launched on April 7 promising that Anthropic had found thousands of high and critical severity vulnerabilities in open source software. Seven months on, the ledger reports 37,966 findings. Of those, 217 are marked fixed.
That gap is not proof the tool is useless. It is proof that we automated the cheap half of the job and then described the automation as the achievement.
📉 The ledger, read plainly
The public view shows 7,349 findings disclosed, 19.4% of the total. Of that disclosed set, 419 have been withdrawn and 1,654, about 4.4%, are marked duplicate. The rest are open, which is the honest way to say nobody has decided yet.
The movement since September is what I find hard to argue with. Findings went from 26,153 to 37,966. Fixed went from 202 to 217. Withdrawals went from 245 to 419. Duplicates went from 2 to over 1,600.
Meanwhile the claimed true positive rate rose from 90.8% to 94.2%. That is the number I would push on hardest, because a rising hit rate in a dataset where duplicates and withdrawals grow faster than fixes is not obviously measuring what the label says. A finding that sat unvalidated for five months and got independently discovered in the meantime does not become a better finding retroactively.
On the CVE side Garrity tracks 442 vulnerabilities attributable to Anthropic, about 63 a month, roughly 0.5% of the 93,450 CVEs published this year. Only two appear in VulnCheck’s exploitation dataset, CVE-2026-61500 and CVE-2026-26980.
I want to be careful with that 0.45%. A bug nobody has patched is a bug nobody has had a chance to exploit. Two out of 442 is a reason not to panic, not a reason to conclude the findings were worthless. What it does support is narrower: the bottleneck Glasswing announced it had broken was not the one holding back open source security.
🧪 Give the tool its due
The case for AI scanning got a strong data point this cycle, from the least sentimental maintainer in the ecosystem.
CVE-2026-92392 is a use after free of a struct Curl_easy in curl’s HTTP/2 upload path. When a server resets an upload with an RST_STREAM carrying HTTP_1_1_REQUIRED or REFUSED_STREAM, curl mishandles the frame and keeps using freed memory. The advisory states it has been proven convertible into remote code execution if a specific set of conditions is met by the malicious server. The affected range is 8.12.0 through 8.22.0, every release since February 2025.
The report is credited to “Luna with Claude, Anthropic.” Daniel Stenberg identified the reporter as Luna Tong at Anthropic, working through OSS Scanner, and the report arrived on September 15. Stefan Eissing’s fix was a small reorder in lib/multi.c. curl rated it High, and the project had published exactly two High severity CVEs since 2021, the last being CVE-2023-38545. The team shortened the release cycle and shipped 8.23.0 on October 14 with the fix and 23 other CVEs, nearly all Low.
That is a real win against a codebase that has been through OSS-Fuzz, Coverity, CodeQL and multiple paid audits. The rest of Anthropic’s launch testimonials point the same way. Anthropic ran 97 critical and high severity findings from 48 projects past the expert penetration testers who review its coordinated disclosure work, and 85 of them, 88%, met the bar. Eleven of the remaining twelve were real but already known; one was invalid.
So quality at the high end is not the problem. Hold that thought.
🚚 The bottleneck got addressed to someone else
Here is Anthropic’s own accounting from the October 8 OSS Scanner launch: it had discovered more than 29,000 candidate vulnerabilities and had been able to manually review and triage approximately 6,000. It said plainly that it remained “bottlenecked on our human capacity to validate these findings.”
The response was not to hire triagers. It was to ship an opt-in scanner whose output is, quoting the README, model generated and not reviewed by a human. No 90 day disclosure period. Findings will not be made public.
The defensible version, which Anthropic states openly, is that projects asked for everything, roughly 5,000 unvalidated reports had already gone out in bulk at maintainer request, and the alternative was a queue that never clears. I believe that account. It is also a description of moving a cost, not removing one.
The detail I keep returning to is the missing clock. It reads like a courtesy, and in one sense it is, since it takes deadline pressure off a volunteer. It also removes every deadline from the producer. Coordinated disclosure, for all its friction, forced a conversation with an endpoint: a date, a patch, an advisory, a decision. A model generated report with no clock and no publication is an inbox item that can sit forever, and the party who benefits from it sitting is the party that generated it.
🔍 curl ran the experiment for us
This month Stenberg said curl had received a batch of 45 reports from Anthropic. Anthropic rated one as medium and the rest as low. He moved them into GitHub at a deliberate pace, in his words to soften the impact for the team. Of the 34 published so far, 19 were marked not a vulnerability, six were confirmed Low, and nine await assessment. That is a 55.9% rejection rate, with 17.6% confirmed, all Low.
The fair reading, because this comparison gets abused in both directions: Anthropic’s 88% covers 97 critical and high findings reviewed by professional pen testers. curl’s batch was almost entirely Low. Different populations. Anthropic never claimed 88% for its low severity tail, and OSS Scanner is explicitly unreviewed output. Both can be true. Neither tells a maintainer what the next 45 emails will cost.
The severity gap is where the two sides genuinely disagree. In September Garrity found Claude rated 91.5% of ledger findings critical or high, while the maintainers assessing the same findings rated only 51.3% that way. Anthropic concedes that some maintainers said ratings can be inflated or that the scanner misunderstood the threat model. So the number on a report is not yet a prioritization signal for the person receiving it.
Then the decision that should be the headline. On October 17 curl announced that from October 26, every report at Low or Medium goes straight into the public GitHub issue tracker. Only High and Critical keep an embargo. The stated reason was to make the curl security team survive. Stenberg noted they had received 13 reports on a single Saturday and could not manage them in secret within a tiny team. On November 3 he published the new flow: public issues, public severity tags, and an open invitation for anyone qualified to argue with the curl team’s assessment.
Sit with the shape of that. The project most often cited as the success story of AI vulnerability discovery responded by giving up coordinated disclosure for the long tail, because coordinating cost more than the bugs did.
⚖️ What I would ask for
I am not arguing Glasswing should stop. I am arguing the scoreboard points at the wrong output, and as long as it does, the visible metric improves while the thing that protects users stays put.
Three things before anyone calls this a success. Publish false positive and severity agreement rates by severity band, not one blended true positive number, because High and Low findings from the same system have wildly different reliability and land on the same person. Calibrate severity against each project’s threat_model.md before the report leaves the building, since the scanner already accepts a threat model and therefore already has the inputs to stop calling a post-auth issue critical in a project that does not consider post-auth issues critical. And pay the maintainers. There is a comment under Stenberg’s thread proposing a reverse bug bounty, funded by AI companies and paid to projects for every AI assisted report they triage. It was written half as a joke and it is the only proposal there that puts the cost where the benefit is. Free Claude Max 20x subscriptions help write the patch and do nothing about the hours spent deciding whether there should be one.
For anyone not a maintainer, the practical point is simpler. These reports go to volunteers, so your dependency tree’s security posture now depends on how much unpaid triage those volunteers can absorb in a given week. curl publishing Low and Medium reports immediately previews what other projects will do as volume arrives. A CVE count is not a quality signal in either direction, and a rising one is now as likely to mean someone pointed a scanner at a codebase as it is to mean the codebase got worse.
🧠 Final Thoughts
The interesting question was never whether a frontier model can find bugs in C. It can, and CVE-2026-92392 is the receipt. The question is what happens when finding becomes free and fixing stays expensive, and the honest answer from seven months is that we renamed the expensive part and mailed it to the people with the least slack.
37,966 findings and 217 fixes is not a scandal. It is an accounting statement, and it says the invoice went somewhere else.
Thanks for reading.