Cybersecurity firm specializing in vulnerability and exploitation intelligence, including KEV and NVD++ data.
VulnCheck's tracking shows that seven months into Anthropic's Project Glasswing, Claude has produced 37,966 candidate vulnerabilities while only 217 have been recorded as fixed publicly, with roughly 12,000 new candidates but just 15 new fixes in the past two months. With 419 retractions and 1,654 duplicates, the data exposes a severe mismatch between AI-driven vulnerability discovery and the open-source community's capacity to remediate.
VulnCheck's seven-month audit of Anthropic's Project Glasswing shows 37,966 reported findings, yet only 19.4% were made public and just 217 marked fixed; 442 received CVE IDs and only two were exploited in the wild. Discovery is far outpacing remediation, with nearly 12,000 new findings but only 15 additional fixes since September, exposing a widening gap between AI-driven vulnerability discovery and maintainer capacity.