Before the Hugging Face incident, the biggest story in AI and security this year was a different kind of breach — of expectations. On 8 April 2026, Anthropic announced Claude Mythos Preview, a model it said could autonomously find zero-day vulnerabilities and write exploits for them, and Project Glasswing, a consortium given early access to use it defensively. The pitch was arithmetic: scan the open-source software the world depends on, find the bugs before attackers do, fix them.
The first half of the arithmetic worked. Anthropic scanned more than a thousand open-source projects and reported 6,202 high- or critical-severity vulnerabilities. It handed 1,752 of them to six independent security firms to check. Of those, 90.6% were genuine and 62.4% were confirmed high or critical. A model that finds real, severe bugs at that rate, at scale, is not hype.
The second half is where the story lives. As of this week, Anthropic’s own disclosure ledger — a public record it published in May and had barely touched until a backfill in early September — tells the following story. Total findings claimed: 26,153. Findings that have reached the ledger at all: 2,736 (10.5%). Findings actually fixed: 202 (0.8%). Findings withdrawn: 245 — more than have been fixed. Eighteen were patched by someone else before Anthropic reported them. And Anthropic’s dashboard claims 421 patched upstream while the ledger it maintains shows 202. The numbers do not reconcile with each other, let alone with the announcement.
Anthropic has been candid about why. Maintainers are severely capacity-constrained. Some have asked it to slow down because they need time to design patches. Open-source maintainers were, by Anthropic’s own account, already facing a deluge of low-quality AI-generated bug reports before Glasswing began. Finding bugs turned out to be the easy part. The hard part is a person with a day job reading the report, confirming it, writing a fix that does not break anything, and shipping it.
This is not a story about one company. Every piece of the responsible-disclosure system — the 90-day embargo, CVE numbering, CVSS scoring, government “known exploited” deadlines — was designed around how fast humans find bugs. That pace was the hidden load-bearing assumption. At Black Hat in August, the CVE Program itself was discussing automation to weather what people have started calling a “vulnpocalypse.”
Anthropic promised a public 90-day report in early July. We could not confirm that a standalone document ever appeared; what exists is the ledger and outside analysis of it. Whether that report was quietly folded into the ledger or never written, its absence is part of the story: the project that was going to show the industry how AI-scale disclosure works has so far shown mainly that it does not, yet.
The deep dive looks at the three ledgers that don’t agree, the severity gap between what Claude scores and what maintainers score, and what a maintainer with two volunteers is supposed to do with four hundred reports.
Want the sources, timeline and detail? Read the deep dive (6 min).