Researchers from VulnCheck analyzed the achievements of the Glasswing project, created by Anthropic to identify vulnerabilities and improve the security of critical software. Over the seven months of the project’s existence, 37,966 problems were identified, for 7,349 (19.4%) of which information has already been published publicly. Of the publicly disclosed issue reports, 217 were marked fixed, 1,654 were found to be duplicates, 419 were retracted, and only 2 issues were found to be used in actual attack by malicious actors.
Despite the fact that the number of duplicate and retracted reports is 9.5 times higher than the number of fixed issues, Anthropic announced an increase in the proportion of confirmed positive results from 90.8% to 94.2%. Over the past two months, Anthropic has identified 11,813 new issues, but only 15 fixes during that time, demonstrating a widening gap between vulnerabilities discovered and fixed.
The situation is made worse by the fact that the work to confirm vulnerabilities identified as part of the OSS Scanner initiative, is left to the maintainers, who find themselves inundated with unverified bug reports. Of the more than 29 thousand problems identified, manual verification was carried out for only 6,000, and there were not enough people to check the rest, so the company began sending reports without manual confirmation.
The curl project, during a manual review of 34 similar vulnerability reports, rejected 19 and recognized 6 as benign (the remaining 9 are still at the verification stage).
If we consider 442 Anthropic report, which were assigned CVE identifiers, 50 of them (11.21%) have a critical level of danger, 189 (42.38%) have a high level of danger, 143 (32%) have a medium level of danger, and only 36 (8.07%) have a low level of danger.