Cybersecurity data reveals that out of 37,966 findings reported by Anthropic, only 217 have been marked as fixed, with merely two identified as actively exploited in the wild. Maintainers face an uphill battle as new discoveries continue to outpace remediation efforts, exemplified by nearly 12,000 submissions logged since September alongside just 15 additional fixes. For instance, maintainers of the curl project rejected 19 out of 34 published reports, validating just six as low-severity flaws. Despite high duplicate counts and community pushback, Anthropic claims its true positive rate has risen to 94.2%.
Key points
The flood of automated vulnerability alerts creates a significant triage burden by shifti…: The flood of automated vulnerability alerts creates a significant triage burden by shifting validation work onto open-source maintainers.
A high volume of duplicate and withdrawn reports contrasts sharply with Anthropic's risin…: A high volume of duplicate and withdrawn reports contrasts sharply with Anthropic's rising self-reported true positive accuracy rate.
Discovery of new security findings is drastically outpacing the actual remediation and re…: Discovery of new security findings is drastically outpacing the actual remediation and resolution of reported software flaws.
Sources checked by our analysis pipeline: 1
Key Takeaways:
- Seven months into Project Glasswing, VulnCheck has tracked 442 CVEs attributable to Anthropic, roughly 0.5% of all CVEs published this year, with only two identified as exploited in the wild. Of Anthropic’s 37,966 reported findings, only 7,349 (19.4%) have been made public and just 217 have been marked fixed.
- Since September, Anthropic has added nearly 12,000 findings while recording just 15 additional fixes, widening the gap between discovery and remediation.
- Roughly 1,654 findings (4.4%) have been marked as duplicates, nearly eight times the number fixed, and another 419 have been withdrawn.
- Anthropic’s claimed true positive rate has risen from 90.8% to 94.2%, raising questions about how it accounts for duplicates and withdrawn findings.
- Anthropic’s OSS Scanner shifts validation work to maintainers, with curl rejecting 19 of 34 published reports as vulnerabilities, confirming six as low severity and leaving nine awaiting assessment. Also putting Anthropic's true positive rates into question.
We're seven months into Anthropic's flagship Project Glasswing, and it's time for another update on the results. I've been tracking the project to see…
Substantial top-line growth at the artificial intelligence firm is being outweighed by significant ongoing expenses, according to reporting from The Wall Street Journal. The financial dynamics reveal that aggressive spending continues to challenge overall profitability despite immense customer demand. Consequently, operations require massive capital deployment to sustain current commercial momentum.
Growing top-line momentum has done little to immediately stem the high costs of running cutting-edge artificial intelligence infrastructure. Financial disclosures show that operating deficits continue to expand despite massive commercial adoption, forcing tech leaders to balance heavy spending against increasing demands for long-term viability. The results come as market enthusiasm remains robust enough to fuel landmark public market debuts across the generative AI sector.
Internal financial disclosures published by The Wall Street Journal reveal a notable quarterly shift in the artificial intelligence firm's core operational metrics. The figures suggest the company reduced its negative margins as it progressed from the second to the third quarter. This reporting came to light through archived aggregation records detailing the enterprise's performance.