Glasswing audit yields underwhelming findings after 7 months
The gist
VulnCheck attributes 442 CVEs to Anthropic's Project Glasswing seven months after launch, with two exploited in the wild.
The gap between Anthropic's and maintainers' severity ratings is the crux.
How it unfolded
- Apr 7, 2026Anthropic launches Project Glasswing, claiming thousands of high- and critical-severity vulnerabilities found and being responsibly disclosed to open source maintainers.
- Apr 17, 2026VulnCheck begins tracking Anthropic's discovered vulnerabilities in an open source repo called Anthropic Credited CVEs.
- Sep 8, 2026VulnCheck publishes 'The Anthropic Glasswing Receipts Are Starting to Trickle In.'
Key terms
- CVEs
- A unique identifier in the CVE system for a publicly known information-security vulnerability.
- exploited in the wild
- A method or piece of code that takes advantage of software vulnerabilities, often to gain unauthorized access or control.
- open source maintainers
- Software whose source code is freely available for anyone to use, study, modify, and distribute.
Source: Wikipedia