Anthropic's Project Glasswing Identifies Numerous Security Flaws, Few Fixed
Anthropic's Project Glasswing, an initiative offering frontier AI models to security researchers to find and remediate software vulnerabilities, has been criticized for identifying a large number of security flaws but delivering few actual fixes. According to a report by vulnerability researcher Patrick Garrity of VulnCheck, after seven months, Project Glasswing has enabled researchers to find 37,966 candidate vulnerabilities. However, only 7,349 (19.4%) are listed in Anthropic's public tracking register, and of these, 5,276 have been validated as unique vulnerabilities. A mere 217 vulnerabilities, less than 0.5% of the total claimed, have been publicly fixed. Anthropic acknowledges being 'bottlenecked on human capacity to validate these findings' and has launched an Open Source Security Scanner (OSS Scanner) to allow maintainers to self-scan and triage findings, and has sent nearly 5,000 unverified reports directly to maintainers.