AI news ·
VulnCheck Finds Glasswing Vulnerability Discovery Outpacing Fixes
An audit found Anthropic’s vulnerability tool reported 37,966 findings but only 217 fixes, shifting triage work to open-source maintainers.
VulnCheck’s latest audit of Anthropic’s Glasswing vulnerability discovery tool counted 442 CVEs credited to the system. Anthropic’s own ledger, however, recorded 37,966 findings against just 217 fixes, a gap that highlights the difference between raw discovery volume and completed remediation.
The audit notes that duplicates, withdrawn reports, and false positives are shifting triage costs onto open-source maintainers. These maintainers must filter a high number of submissions to identify actionable vulnerabilities, a burden that falls outside the fix count tracked by the originating tool.
For teams in insurance, legal, development, and research roles, the data underscores that the number of findings a tool generates does not directly measure its impact on security outcomes. The operational load created by unverified or redundant reports can affect resourcing decisions and risk assessments tied to open-source software supply chains.