# Anthropic's Project Glasswing Faces Scrutiny Over Vulnerability Reporting Efficacy Seven months into the initiative, open-source maintainers report high false-positive rates and significant triage burdens. - **Source:** [Hacker News (news.ycombinator.com)](https://brifing.si/source/13c923cd-6d99-442b-9b8b-1181f4d8cd91) - **Published:** 2026-11-10 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/e2f87bf0-289a-4aea-acc7-d729110c54ed ## Project Glasswing Performance Gap Launched on April 7th, Anthropic's Project Glasswing aimed to identify critical vulnerabilities in open-source software. Seven months later, independent tracking reveals a significant discrepancy between the company's claims and reality. While Anthropic reports nearly 38,000 findings, only a small fraction have been confirmed as fixed or publicly disclosed by maintainers. ## Data Discrepancies and Duplicates Anthropic's public ledger currently lists 37,966 findings, yet only 217 are marked as fixed. Alarmingly, 1,654 findings are categorized as duplicates, which is 7.5 times higher than the number of verified fixes. This suggests that the project's internal feedback loop for validating true positives may be failing to account for external resolutions. ## Shifting the Triage Burden Anthropic acknowledged that manual review of 29,000 candidate vulnerabilities created a severe bottleneck. To address this, they launched an OSS Scanner that allows maintainers to request and triage reports themselves. This shift effectively moves the labor-intensive validation process from Anthropic's internal teams directly onto the already overwhelmed open-source project maintainers. ## Real-World Impact Analysis Of the 442 CVEs attributed to Anthropic, only 0.45% have been exploited in the wild according to VulnCheck data. This low exploitation rate contrasts sharply with the project's initial framing of identifying high-severity threats. Most findings appear to be low-impact, raising questions about the actual utility of these AI-generated reports. ## The Curl Project Case Study Recent data from the curl project provides a rare look at validation accuracy. Out of 34 reports published, 19 were deemed not a vulnerability, resulting in a 55.9% false-positive rate. Only 17.6% of findings were confirmed, all of which were classified as low severity, contradicting Anthropic's claims of high-severity discovery. ## Severity Rating Disagreements A persistent issue is the gap in severity assessment between AI models and human maintainers. While Anthropic's Claude model rated over 91% of findings as critical or high severity in September, human maintainers assessed only 51.3% of those same findings with that level of urgency, indicating a fundamental misalignment in risk perception. ## Scaling Issues in Automation The transition to a self-service scanner highlights the limitations of current AI-driven vulnerability detection. Without robust human triage, the volume of unverified reports threatens to overwhelm maintainers. The reliance on model-generated reports without human review risks flooding the ecosystem with invalid data, potentially distracting security teams from genuine, high-priority threats. ## Future of Vulnerability Management The seven-month update suggests that while AI is a powerful tool, it is not a panacea for security research. The project's struggle to reconcile its narrative with empirical evidence highlights the need for better data accuracy. Future success depends on reducing false positives and ensuring that automated findings provide actionable, verified intelligence. ## Sources covering this story - https://www.vulncheck.com/blog/anthropic-glasswing-november-update — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._