VulnCheck counts 442 CVEs from Anthropic's Glasswing, with 217 of 37,966 findings fixed

Vulnerability intelligence company VulnCheck says in a blog post that, seven months into Project Glasswing, it has tracked 442 CVEs attributed to Anthropic, equal to about 0.5% of CVEs published in 2026. Only two of those vulnerabilities have been linked to exploitation in the wild.

Anthropic's Project Glasswing ledger listed 37,966 findings as of November 2. Of those, 7,349 were public, 217 were marked fixed, 419 were withdrawn and about 1,670 were classified as duplicates. Since September, the ledger added 11,813 findings but only 15 additional fixes.

The ledger's claimed true positive rate increased from 90.8% in May to 94.2% in November. VulnCheck compared that figure with results from curl, which received reports through Anthropic's free OSS Scanner for open source projects. Of 34 published curl reports, maintainers classified 19 as not vulnerabilities, confirmed six as low severity and had nine awaiting assessment.

Anthropic describes OSS Scanner reports as "fully model-generated, without human review or triage", leaving maintainers to assess them. VulnCheck, which sells vulnerability and exploitation data, says the figures question how Anthropic counts true positives.