Project Glasswing Update: VulnCheck Tracks 442 Anthropic-Attributed CVEs

Seven months into Anthropic's flagship Project Glasswing, security analytics firm VulnCheck has released comprehensive tracking data showing 442 CVEs attributable to Anthropic—representing roughly 0.5% of all CVEs published this year, with only two confirmed as exploited in the wild.

Out of 37,966 reported findings, only 7,349 (19.4%) have been made public, with just 217 marked as fixed. Since September, Anthropic added nearly 12,000 new findings while recording only 15 additional fixes, widening the remediation gap. Furthermore, discussions continue regarding duplicate findings, claimed true positive rates rising to 94.2%, and the burden placed on open-source maintainers by automated scanners.