VulnCheck tracker finds 442 Anthropic-credited CVEs, only 217 marked fixed
The gist
VulnCheck counted 442 CVEs credited to Anthropic's AI bug hunt, with two exploited in the wild.
Most of Anthropic's 37,966 findings remain unfixed, so maintainers carry the review load.
How it unfolded
- Apr 7, 2026Anthropic launches Project Glasswing, saying it identified thousands of high- and critical-severity vulnerabilities for responsible disclosure to maintainers.
- Apr 17, 2026VulnCheck's Patrick Garrity starts the Anthropic Credited CVEs tracker, before Anthropic has its own disclosure ledger.
- May 2026Anthropic's ledger reports 23,019 findings and a 90.8% true positive rate.
Key terms
- CVEs
- A unique identifier in the CVE system for a publicly known information-security vulnerability.
- true positive rate
- The proportion of actual positive cases that a test correctly identifies as positive, also called sensitivity.
- exploited in the wild
- A method or piece of code that takes advantage of software vulnerabilities, often to gain unauthorized access or control.
Source: Wikipedia