VulnCheck Glasswing November Update: 442 CVEs, 217 Fixes, curl Triage

Seven months after Project Glasswing launched, VulnCheck researcher Patrick Garrity published a November 9, 2026 follow-up that pairs Anthropic’s public disclosure ledger with CVE attribution, Known Exploited Vulnerability (KEV) matches, and Daniel Stenberg’s live triage of Anthropic OSS Scanner reports sent to curl. The piece does not claim frontier cyber models are useless; it argues the volume–fix–severity story still outruns maintainable remediation.

The analysis extends Garrity’s July exploitation report, which found AI-assisted public CVEs exploited at roughly the baseline KEV rate. This update adds ledger mechanics: surging duplicates and withdrawals, stalled fixes while findings grow, and maintainer-side validation after Anthropic shifted unreviewed batches to projects that opt in.

TL;DR

Agents that act on your behalf need rules. See how explainx helps secure your agents →

What changed since the April Glasswing launch

Anthropic announced Project Glasswing on April 7, 2026, saying partners had already found thousands of high- and critical-severity vulnerabilities heading toward coordinated disclosure. That headline set expectations for maintainers, investors, and lawmakers debating Mythos-class access.

Garrity began an independent ledger on April 17 in the open Anthropic Credited CVEs repository because Anthropic’s own disclosure ledger updates in infrequent bulk batches. His November post is the fifth in a series; our July coverage already compared AI discovery counts to KEV exploitation share.

The new numbers focus on remediation throughput and severity alignment, not whether a model can spot a bug in a lab.

Ledger growth versus fixes and public disclosure

Anthropic’s November 2 ledger snapshot, as summarized by Garrity:

Garrity notes nearly 12,000 findings arrived in roughly two months while only 15 additional fixes registered. Duplicates jumped from two to thousands, matching his September warning that unresolved queues collide with human discovery elsewhere.

He also flags 1,654 duplicates (4.4%) and 419 withdrawals against 217 fixes, and questions how a rising 94.2% true positive rate squares with withdrawals and duplicates piling up faster than remediated items.

Project Glasswing November ledger totals tracked by VulnCheck for Anthropic vulnerability findings Image: VulnCheck

Builder takeaway: if you ingest Glasswing-style feeds into CI, budget deduplication and severity re-ranking pipelines, not just ticket openers. Our Trail of Bits patching regression work shows fix quality matters as much as find volume.

CVE attribution versus ledger marketing

On the CVE side, Garrity reports 442 vulnerabilities attributable to Anthropic in his tracker, more than double the 217 fixes Anthropic’s ledger lists. That gap can reflect disclosure timing, non-CVE advisories, and partner-private work, but it is the reference set VulnCheck uses for exploitation math.

Against VulnCheck KEV, only two credited CVEs show known exploitation:

• CVE-2026-61500
• CVE-2026-26980 (also discussed in our July Glasswing exploitation post)

That is 0.45% of the 442-set. Garrity contrasts the Mythos-era danger narrative with public exploit telemetry, while stressing AI still shrinks time-to-patch when triage works.

Readers comparing vendors should cross-check OpenAI GPT-6 Cyber exploit pipelines, Collinear CWE-bench defensive tasks, and UK AISI cyber eval incidents to see offense-heavy marketing versus patch-loop benchmarks.

OSS Scanner: triage moved to maintainers

When human review could not scale, Anthropic launched the OSS Scanner on October 8, 2026, noting 29,000+ candidate findings but only ~6,000 manually reviewed, with ~5,000 unverified reports already emailed to maintainers who requested bulk delivery. Reports are fully model-generated without human triage, per Anthropic’s disclaimer.

Garrity’s framing: the bottleneck did not disappear; it moved downstream to volunteers and corporate maintainers already stretched by PHP2Shell response and routine CVE load.

curl gives a ground-truth sample

Three days before the VulnCheck post, curl maintainer Daniel Stenberg described receiving 45 vulnerability reports from Anthropic’s scanner path, rating one medium and the rest low, and publishing issues slowly to avoid drowning the team.

Of 34 reports published when Garrity wrote:

That yields a 55.9% false-positive rate on published items so far and 17.6% confirmed, all low severity in the confirmed bucket. Stenberg linked the batch on his blog; Garrity embeds VulnCheck’s chart.

curl maintainer triage chart for Anthropic OSS Scanner Glasswing vulnerability reports Image: VulnCheck

This rhymes with Stenberg’s May note that five Mythos findings collapsed to one confirmed curl issue, and with Garrity’s September severity mismatch: Anthropic labeled 91.5% of ledger items critical or high while maintainers rated 51.3% that way in his earlier sample.

If you maintain open source, treat scanner email like untrusted fuzzer output: require reachable exploit paths, default-config impact, and regression tests before issuing CVEs. Our zero-day explainer walks disclosure clocks; OSS Scanner explicitly does not run the same coordination timeline.

What developers are saying

Hacker News readers argued past the headline in both directions on thread 50447074:

• sigmar (comment 50448708) said fast patching can keep KEV counts low, so low exploitation share is not proof of failure.
• pizlonator (comment 50448745) reported nine Fil-C reports from Anthropic, all real bugs with exceptional report quality, contrasting curl’s batch.
• simoncion (comment 50449972) pointed to Greg Kroah-Hartman’s high false-positive anecdotes and argued commenters ignored OSS Scanner stats while debating ledger percentages.
• rurcliped (comment 50448662) said the post mischaracterizes Glasswing because many discoveries happen on private partner code never destined for the public ledger.
• enthuseyourcurb (comment 50448590), claiming big-tech experience, argued public CVE under-counts company-ending issues that never receive numbers.
• delichon (comment 50447517) worried about a find-versus-fix ratio of 37,966 to 217 if it generalizes.

None of these comments are verified facts; they show maintainer burden, metric selection, and private versus public discovery as the live debate.

What this means for agent and AppSec teams

Discovery tools are not patch tools. If you wire Claude Security or third-party scanners into repos:

1. Cap auto-ticket rate and require human or policy gate for severity above low.
2. Deduplicate against existing GHSA/CVE before paging on-call.
3. Measure time-to-merge fix PR, not raw finding count OKRs.
4. Separate partner-private red team results from public ledger KPIs when reporting upward.

For agent pipelines that write patches, pair scanning with regression harnesses and runtime guardrails. AgentBeam focuses on stopping autonomous agents from executing dangerous actions when scanners or coders go haywire; it complements, not replaces, maintainer triage.

How to verify the numbers yourself

1. Clone or browse vulncheck-oss/anthropic-credited-cves and diff against Anthropic’s ledger CSV exports.
2. Filter the ledger for disclosed versus fixed and compare Garrity’s claim about disclosed inflation using Anthropic’s UI filters.
3. Watch curl GitHub issues filed from the Anthropic batch for final dispositions.
4. Cross-check KEV entries for CVE-2026-61500 and CVE-2026-26980 in CISA’s catalog.

Anthropic has not published a point-by-point rebuttal to this VulnCheck post in the materials we fetched on November 11, 2026. Watch its transparency pages and Mythos 5.2 security scans for counter-metrics.

Why public CVE math understates partner work — and why it still matters

Glasswing’s public ledger is only the coordinated disclosure slice. Anthropic has repeatedly said Mythos-class partners scan proprietary stacks that may never become CVEs. That is real defender value, and HN commenters such as enthuseyourcurb argued corporate incidents will never appear in Garrity’s CSV.

The tension is accountability. When Anthropic’s April launch quoted thousands of critical findings heading to open-source maintainers, policymakers and CISOs reasonably watched fix velocity on public code. Seven months later, 217 fixes on 37,966 ledger rows is a signal about operational scaling, even if private partner counts look better.

For teams buying Claude Enterprise security scans, ask vendors for your metrics: true positive rate after human review, median days to merged fix, severity after maintainer downgrade, and duplicate rate against existing GHSA. Do not import ledger marketing KPIs into your SOC without that filter.

Comparing offense models, Vals AI cyber range results show how gating shapes measured risk versus open weights. Glasswing’s structure keeps Mythos behind partners; OSS Scanner pushes ungated model output straight to inboxes. curl’s triage is the first visible quality control point on that new path.

Related reading

• VulnCheck July 2026 exploitation rates
• GPT-6 Cyber vs Claude Mythos and Glasswing
• Anthropic OSS Scanner for maintainers
• PHP2Shell timeline and patching pressure
• Claude Security public beta
• Cyber AI models compared
• Trail of Bits on fix regressions

Ledger figures, curl triage counts, and KEV matches reflect VulnCheck’s November 9, 2026 post and linked maintainer blogs as of this article’s publication date.