Seven months into Anthropic’s Project Glasswing, a vulnerability researcher argues the programme is producing more paperwork than fixes.
Patrick Garrity of VulnCheck published the assessment on November 9, working from Anthropic’s own disclosure dashboard. His framing: maintainers are being overwhelmed while the findings underwhelm.
From 37,966 reports to 217 fixes
Anthropic’s ledger, dated November 2, credits Glasswing researchers with 37,966 candidate vulnerabilities. Only 7,349 appear in the public tracking register.
Of those, Garrity counts 5,276 as validated unique bugs. The remainder splits into 1,654 duplicates and 419 withdrawals.
Of the validated set, roughly 4,866 reached maintainers and 193 remain in pre-disclosure. That leaves 217 marked fixed, under half a percent of the top-line claim.
Between September and November, Anthropic added 4,613 findings to the ledger and recorded 15 fixes in the same window. Another 1,668 of the new entries were duplicates.
The triage bottleneck is human
Anthropic has been candid about this. In October it said it had generated over 29,000 candidates but manually reviewed only about 6,000, and that it remains bottlenecked on human capacity to validate.
Garrity also questions the reported 94.2 percent true-positive rate given the duplicate and withdrawn volume.
The defender takeaway is less about Anthropic than about all AI-assisted discovery. A model that finds bugs faster than maintainers can triage them shifts the constraint rather than removing it, and a findings queue nobody drains is not security. Programmes adopting similar tooling should budget for reviewers, not just inference.
