Cybersecurity

Twenty-six thousand findings, two hundred fixes: Glasswing and the disclosure pipeline it broke

Anthropic's Mythos found 26,153 vulnerabilities; 202 are fixed. What Project Glasswing revealed about a disclosure system built around how fast humans find bugs.

— Nodal Studio

Illustration: a person asleep at a desk under a lamp, buried in printed reports and surrounded by coffee cups.

The validation numbers

From Anthropic’s Glasswing update (May 2026) and the Mythos Preview system card:

  • Projects scanned: >1,000
  • High/critical findings reported: 6,202
  • Independently assessed: 1,752, by six security research firms
  • Validated true positive: 90.6%
  • Confirmed high or critical severity: 62.4%

These are strong figures and the reason the rest of this article is not a debunking. The model works. The bottleneck is downstream — and, as we’ll see, the severity claims are shakier than the validity claims.

Three ledgers that don’t reconcile

VulnCheck’s Patrick Garrity has tracked Glasswing since the 7 April launch. His 8 September analysis of the backfilled ledger:

SourceTotal findingsReached disclosureFixedNote
Anthropic dashboard26,153—421 “patched upstream” (→ 462 advisories)Dashboard figure
Anthropic disclosure ledger (main), post-backfill26,1532,736 (10.5%)202 (0.8%)2,096 disclosed-not-fixed; 191 pre-disclosure; 245 withdrawn; 2 duplicate
CVE / GHSA sub-ledgers———CVE ledger lists 70 CVEs; main ledger lists 82. GHSA ledger lists 49; main ledger lists 77.
VulnCheck public-record tracking23,019 candidates (Jul)1,596 reached maintainers (Jun)126 published CVEs; 1 confirmed exploited in the wild (Jul)Independent

Garrity’s own summary is quotable and fair: the receipts “just don’t reconcile.” His specific observations:

  • Only 9.8% of findings have reached a maintainer five months in. Anthropic acknowledges this in the ledger itself: human triage and review is “the rate limiting step.”
  • The 202 fixed findings span 113 projects — 1.79 fixes per project. The ledger holds more withdrawn/duplicate findings than fixed ones.
  • The 421-vs-202 discrepancy is likely definitional (patched upstream vs. confirmed fixed in the ledger). But a disclosure ledger’s whole purpose is to be the number of record. Two numbers from one organisation is a governance problem, not a rounding one.
  • Timestamps mislead. The ledger has had only two bulk updates, so a finding’s “public reveal date” isn’t when it actually appeared.

The severity gap — where “critical” is doing a lot of work

The most important new detail in the September ledger is that it now shows both Claude’s severity rating and the maintainer’s. They diverge sharply:

  • Claude rated 91.5% of findings critical or high.
  • Maintainers rated 51.3% of the same findings critical or high.

That is a 40-point gap, and the ledger doesn’t publish the CVSS metrics behind Claude’s scores, so the root cause can’t be audited from outside. Garrity’s read: the model is probably making “a generic determination rather than a well-crafted prompt written by someone with subject-matter expertise on severity.” This matters because the headline “thousands of critical vulnerabilities” leans on the model’s severity scoring, and the maintainers who own the code cut it roughly in half.

The curl case study — why “91.4% true positive” needs an asterisk

Daniel Stenberg (curl maintainer) documented Mythos’s findings against curl: five reported findings became one. Three were false positives, one was a bug but not a vulnerability, one was a genuine vulnerability. The ledger data is consistent with this pattern. A high validated-true-positive rate on an independently assessed sample can coexist with a much messier experience for an individual maintainer receiving raw findings — because deduplication, reachability analysis and “is this actually a vulnerability or just a bug” are exactly the human triage steps the pipeline is bottlenecked on.

Why aging embargoed findings are a liability

A finding under embargo is an asset only while it is exclusive. Three things erode it:

  1. Independent rediscovery. 18 findings were fixed by someone else before Anthropic reported them. Garrity: “I suspect this issue will compound over time as findings age and maintainers or other researchers find and fix them on their own.” Every additional capable model — and every attacker running one — raises the rediscovery rate. The UCL rediscovery benchmark (Week 5) measures exactly this.
  2. Leakage surface. 2,096 findings are disclosed-to-maintainer but unfixed. Each is known to at least two parties plus everyone with access to the maintainer’s mailbox or tracker.
  3. Policy exposure. As a CVE Numbering Authority for Glasswing findings, Anthropic is bound by its own stated window (90-day publication, 45-day post-patch wait, 14-day extensions, broader exceptions — the practical clock is ambiguous). In June, VulnCheck already counted 10 undisclosed findings past the 90-day window and 168 approaching it. Findings past the window with no publication are a credibility cost; publishing them unpatched is a security cost. At 24,000 queued findings, the policy forces a choice it was not written to make.

Coordinated disclosure’s hidden assumptions

MechanismAssumptionBroken by
90-day embargoResearchers find bugs slower than maintainers can fix themDiscovery at thousands/month vs. maintainers fixing ~2 per project
CVE assignmentCVE volume manageable by CNAs and MITRECVE Program discussing automation to survive volume
CVSS triageSeverity scored by a human per findingSeverity asserted by model; 40-point gap vs. maintainers; CVSS metrics not published
CISA KEV deadlines”Exploited in the wild” is rare, to be fast-trackedMicrosoft’s AI turned 182 of 200 kernel bugs into PoCs at $3.61 each (Week 6)
Maintainer good faithReports are scarce and mostly correctDeluge of low-quality AI reports preceded Glasswing

What a maintainer with 400 findings is meant to do

Honestly: not what the current system asks. Proposals on the table, in rough order of how much they change:

  • Batch, dedupe and rank at the source. The curl case shows why: 5→1 should happen before the maintainer sees anything. The ledger’s 245 withdrawals are triage that landed on humans.
  • Finder supplies the patch. A finder that can write an exploit can usually write a fix; the maintainer’s job becomes review. This shifts, not removes, the bottleneck — and raises the “model vouches for its own patch” problem that surfaced separately this summer.
  • Class-level fixes over instance-level fixes (Weston’s Black Hat argument, Week 6): 400 memory-safety bugs is not 400 patches.
  • Tiered embargo by project capacity. A 90-day clock means different things to a well-resourced vendor and a two-person project.
  • Funded triage. Anthropic’s donations ($2.5M to Alpha-Omega via OpenSSF/Linux Foundation, $1.5M to the Apache Software Foundation) plus $100M in API credits to partners are a start. The gap between that and the labour implied by 24,000 undisclosed findings is the actual policy question.

Sources

Editorial note: we could not confirm publication of the standalone 90-day Glasswing report promised for early July. If it exists, the light read’s penultimate paragraph should be revised.

Back to the light read (2 min).