VulnCheck tracks vulnerabilities discovered by Anthropic
First seen Nov 10 Updated Nov 11, 23:33 UTC Heat 33 low evidence
VulnCheck published a tracking report on vulnerabilities attributed to Anthropic's Project Glasswing, seven months after launch. VulnCheck claims few findings are public or fixed and questions Anthropic's true positive rate.
- Who should care
- Open-source maintainers and security teams handling AI-generated vulnerability reports.
Key facts
- VulnCheck tracked 442 CVEs attributable to Anthropic, about 0.5% of CVEs this year
- 37,966 reported findings, 7,349 (19.4%) public, 217 marked fixed
- About 12,000 findings added since September, with only 15 more fixes
- 1,654 findings (4.4%) marked duplicates, 419 withdrawn
- Anthropic's claimed true positive rate rose from 90.8% to 94.2%
- curl rejected 19 of 34 published reports as vulnerabilities
Context
Project Glasswing launched on April 7th, per the VulnCheck post.
Timeline
Discussion
-
Tracking Anthropic-discovered vulnerabilitiesvulncheck.com · HN · 447 pts · 217 comments
Evidence
Low evidence: a single community post. Treat it as a claim until someone else confirms it.
Details written Nov 11, 11:26 UTC from the sources listed above.