Project Glasswing CVEs: what Anthropic's disclosure numbers actually show

Project Glasswing is Anthropic's program for finding vulnerabilities in critical software with Claude Mythos Preview, an unreleased model. As of November 2, 2026, Anthropic's own disclosure dashboard says it has disclosed 5,087 vulnerabilities across 680 open source projects, that 629 of them have been patched, and that 733 identifiers have been issued: 230 CVE records and 503 GitHub Security Advisories. Those disclosures come from 37,966 candidate findings, of which external firms reviewed 6,376. Independent trackers count differently: VulnCheck put the number of CVEs attributable to Anthropic at 442 on November 9. The short version is that AI is finding far more issues than maintainers can confirm and fix, and the gap between "found" and "patched" is now the story. This post sets out the numbers from primary sources, explains why they do not match, and says what maintainers and software teams can do. It was checked on November 11, 2026.

Why this is in the news

VulnCheck published a seven-month review of Glasswing on November 9, 2026, arguing that findings are piling up far faster than fixes; it drew 418 points and 202 comments on Hacker News by November 11. The same day, Anthropic announced Claude Fable 5.2 and Claude Mythos 5.2, and said cybersecurity professionals can apply for access to Mythos 5.2 through its Cyber Verification Program. Google autocomplete shows people searching "project glasswing cve", "anthropic project glasswing cves" and "project glasswing companies list", so the questions below are ones people are asking.

What Project Glasswing is

Anthropic announced Glasswing on April 7, 2026. The launch partners named on its page are AWS, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks, and Anthropic says it extended access to over 40 additional organizations that build or maintain critical software infrastructure, without naming them. The model is Claude Mythos Preview, which Anthropic describes as a general-purpose frontier model it does not plan to make generally available. Anthropic committed up to $100M in usage credits and $4M in direct donations to open source security groups. In October 2026 Anthropic said existing Glasswing members would move to the Specialized Access tier of its Cyber Verification Program.

The numbers, from Anthropic's dashboard

Anthropic's coordinated vulnerability disclosure (CVD) dashboard at red.anthropic.com is the primary source. Its figures are all "as of November 2, 2026", and the page notes that disclosed vulnerabilities are a subset of the total because "independent human triage and review is the rate limiting step."

Two things stand out. First, only about one in six candidate findings has been reviewed by a person outside Anthropic, so the 94.2% true positive rate applies to the reviewed set, not to the whole pile. Second, 629 patched out of 5,087 reported means roughly one in eight disclosed issues has a fix upstream so far. That is the bottleneck VulnCheck and maintainers are pointing at.

Why the CVE counts do not match

Search for "how many CVEs has Glasswing found" and you will see different answers. They are mostly measuring different things.

• Anthropic's 230 CVE records and 503 GitHub advisories are identifiers issued for findings in Anthropic's own disclosure process. Many open source projects publish a GitHub Security Advisory without requesting a CVE, which helps explain why advisories outnumber CVEs.
• VulnCheck's 442 CVEs come from an independent tracking repository that counts every CVE "attributable to Anthropic", drawing on CVE records, GitHub advisories, Linux kernel commits and Anthropic's ledger, with manual auditing. That is wider than Glasswing's own process. VulnCheck puts 442 at about 0.5% of the 93,450 CVEs published this year, and says 2 of them are in its Known Exploited Vulnerabilities list.
• Timing. Anthropic's CVD policy aims for a 90-day disclosure deadline, or earlier if a patch ships, and generally waits 45 days after a patch before publishing full technical details. Many findings are inside that window, so public counts lag the real ones.

VulnCheck's post is critical in tone, and some of its conclusions are the author's opinion. Its numbers on duplicates are not consistent within the post itself, so we have not repeated them. The figures above are the ones we could tie to a stated method.

What the false positives look like in practice

The clearest public example is curl. In May 2026 its lead maintainer, Daniel Stenberg, wrote that a Mythos scan of curl reported five "confirmed security vulnerabilities". After review, three were false positives (documented API behavior), one was an ordinary bug, and one was a real, low-severity vulnerability. He also wrote that AI analyzers are significantly better than traditional ones, while seeing no evidence that this setup finds more advanced issues than other AI tools. One project is not a sample, but it matches the shape of Anthropic's own numbers: useful findings mixed with noise, and the cost lands on the people who have to check them.

The OSS Scanner: opt-in reports without human review

On October 8, 2026 Anthropic launched OSS Scanner, an opt-in service modeled on Google's OSS-Fuzz that audits eligible open source projects at no cost. Anthropic says it found over 29,000 candidate vulnerabilities in six months, manually reviewed or triaged about 6,000, and sent nearly 5,000 reports directly to maintainers who asked for everything. The scanner formalizes that: model output goes straight to maintainers who opt in. How it works, per the anthropics/oss-scanner README and launch post:

• Enrollment: core maintainers open a pull request adding projects/<name> with at least repo and primary_contact, plus a Dockerfile to build the project.
• Scanning: the project is built in an isolated VM and scanned with no internet access.
• Reports: each includes a reproducer, an explanation with a bisection, and a candidate patch when available. Anthropic says they are fully model-generated, without human review or triage, and that "it is possible reports will be incorrect or invalid."
• Delivery and control: email to the primary contact (optionally PGP-encrypted) or GitHub private vulnerability reporting, filtered by min_severity. Set disabled: true to pause, or remove the directory to withdraw. Anthropic says it does not place a 90-day disclosure period on these findings and will not make them public.

Anthropic's launch post reports that maintainers' own penetration testers checked 97 critical and high findings across 48 projects, and that 85 (88%) met the bar for its disclosure process; of the other 12, 11 were real but duplicates and one was invalid. That is a vendor-reported figure on the highest-severity slice, not on every report.

What to do about it

If you maintain an open source project

1. Decide your intake before the reports arrive. A published security policy, private vulnerability reporting on GitHub, and a severity floor you are willing to triage save time later.
2. Ask for a reproducer and judge on it. Anthropic's policy says AI-originated reports are labeled as such. Treat a report without a working reproducer as a lead, not a finding.
3. Use the controls. If you enroll in OSS Scanner, set min_severity so low-severity model output does not swamp a small team, and pause it if you need to.

If you ship software that depends on open source

1. Watch GitHub advisories, not just CVEs. Most Glasswing identifiers are GitHub Security Advisories. Dependency scanners that read the GitHub Advisory Database will see them; CVE-only feeds will miss many.
2. Expect more patch releases. With 5,087 issues disclosed and 629 patched, more fixes are on the way. A short, rehearsed upgrade path matters more than ever; our PHP2Shell patch guide shows what that looks like for one real flaw.
3. Prioritize by exploitation, not by count. VulnCheck found 2 of 442 Anthropic-attributed CVEs in its exploited list. Known-exploited and internet-facing issues still come first.

If you use AI to find vulnerabilities in your own code

Anthropic's numbers are a useful warning about your own pipeline: finding is cheap, confirming is expensive. Budget human review, require reproducers, and keep AI security agents in a contained environment (see sandboxing AI agents and our AI agent security checklist). For where AI already helps defenders, see how AI improves threat detection.

How we approach this

This is our approach, not a rule. When we add AI-assisted code review or vulnerability scanning to a client's pipeline, every finding must come with a reproducer or a failing test before it reaches a developer's queue, and we track the share of findings that turn out to be real so the team knows how much to trust the tool. Dependency updates are tracked from the GitHub Advisory Database as well as CVE feeds. Our AI governance and security audit covers this for existing systems.

Sources: Anthropic, Project Glasswing, Anthropic, coordinated vulnerability disclosure dashboard (last updated November 2, 2026), Anthropic, coordinated vulnerability disclosure policy, Anthropic, launching an opt-in vulnerability finding service for open source, anthropics/oss-scanner on GitHub, Anthropic, expanding the Cyber Verification Program, Anthropic, introducing Claude Fable 5.2 and Claude Mythos 5.2, VulnCheck, Glasswing November update, Daniel Stenberg, Mythos finds a curl vulnerability. All read November 11, 2026. Anthropic updates its dashboard in batches, so check it for current figures.