VulnCheck: seven months in, Anthropic's vulnerability ledger shows 217 fixes among 37,966 findings

Security firm VulnCheck, which sells vulnerability intelligence, published its November update on Anthropic's Project Glasswing. These are VulnCheck's figures and its reading, not Anthropic's.

VulnCheck's count: it has tracked 442 CVEs credited to Anthropic since April, about 0.5% of the 93,450 CVEs published this year, and says only two have been exploited in the wild. Of the 37,966 findings on Anthropic's disclosure ledger (as of its November 2 update), VulnCheck says 7,349 (19.4%) are public, 217 are marked fixed, 1,654 are marked duplicates and 419 are withdrawn. Since its September 8 update, it says the ledger added about 11,800 findings and 15 fixes.

True-positive rate: the ledger claims 94.2%, up from 90.8% at launch. VulnCheck questions how duplicates and withdrawals are counted.

curl: VulnCheck relays that curl's maintainer, Daniel Stenberg, received 45 reports from Anthropic's OSS Scanner, one rated medium and the rest low. Of 34 published so far, VulnCheck says 19 were judged not vulnerabilities, 6 confirmed as low severity and 9 await assessment.

VulnCheck says AI is a valuable tool for finding vulnerabilities but that the evidence does not match the launch claims. Anthropic's response is not part of the post.