Glasswing overwhelms maintainers with underwhelming findings (VulnCheck)
Patrick Garrity of VulnCheck has written a blog post that looks at vulnerabilities found by Anthropic's Project Glasswing since it launched on April…
Why am I seeing this Ranked on source trust — LWN
It ranks mainly on source trust: LWN is the most reliable outlet we track on this subject, and is the only one on the story so far.
Single-sourced. No second organisation has confirmed it yet.
Link-outLink-out, because only one organisation carries it and no first-party source is on it and the subject could not be identified from the text. Link-out means we point at the publisher and say nothing of our own.
| Factor | Weight | Score | Contribution | Where it came from |
|---|---|---|---|---|
| Corroboration | 0.35 | 0.39 | +0.135 27% | 1 independent org on the story. Tier-3 aggregators never corroborate — they can show something is circulating, never that it is true. |
| Source trustleads | 0.25 | 0.85 | +0.212 42% | LWN is the highest-trust source on this story. Trust is taken from the best source, not averaged. |
| Pickup rate | 0.20 | 0.00 | +0.000 0% | One counted organisation, so there is no spread to measure — nothing has picked this up to set a rate. |
| Freshness | 0.20 | 0.80 | +0.161 32% | Halves every 10 hours from the newest item on the story. This is the only factor that rewards a story for nothing more than being recent. |
Corroboration counts distinct organisations, once each, and only from tiers 1 and 2. Freshness halves every 10 hours, so this ranking is a snapshot and will differ at the next build.
ScotXW · CC BY-SA 3.0 · Wikimedia Commons · illustrativeProject Glasswing, Anthropic's vulnerability discovery initiative launched in April, has generated nearly 38,000 findings but faces scrutiny over its practical impact. According to VulnCheck analysis, only about 19% of these findings have been made public, and just 217 have been marked as fixed. The project reports a 94.2% true positive rate, up from 90.8% at launch.
The gap between findings and resolutions raises questions about the project's effectiveness. Duplicate findings outnumber fixes by a significant margin, with 1,654 marked as duplicates compared to 217 fixes. Additionally, 419 findings have been withdrawn entirely, suggesting issues with the initial triage process that may not be reflected in the reported true positive rate.
Open source maintainers, who the project aimed to assist, appear to be bearing the triage burden instead. Few of the identified vulnerabilities have resulted in CVEs or active exploitation, and the rate of actual fixes has stalled while duplicates and withdrawals accumulate. The mismatch between Glasswing's launch promises and current outcomes remains unresolved.
What happened
Patrick Garrity of VulnCheck has written a blog post that looks at vulnerabilities found by Anthropic's Project Glasswing since it launched on April 7, and finds it wanting: Of the 37,966 findings Anthropic reports, only 7,349 (19.4%) have been made public. Just 217 of those have been marked fixed. The more glaring number is that 4.4% (1,654) of the project's findings have already been marked as duplicates, 7.5x more duplicates than fixes. AI is a valuable tool for finding vulnerabilities, and I'm not discounting that. But seven months in, the evidence still doesn't match the launch narrative.
How this story arrived
Ordered by when each source was first observed, which is what the velocity figure is computed from. Publishers backdate; observed order does not.
- 01 Lwn first seen Glasswing overwhelms maintainers with underwhelming findings (VulnCheck)
Overclock clusters coverage from independent sources and grades it automatically. The figures above are computed, not editorial. This page summarises and links to reporting by the outlets named — follow the links for the original work.