After 7 Months, Glasswing Overwelms Maintainers with Underwhelming Findings

After seven months, Project Glasswing's findings have raised concerns about its effectiveness. Anthropic launched the project on April 7th, claiming it would identify thousands of high and critical-severity vulnerabilities, but the reality is far different. Out of the 93,450 CVEs published in 2023, Anthropic's project has tracked only 442 CVEs, accounting for just 0.5% of all CVEs.

Of the 37,966 findings reported, only 217 have been marked as fixed. Moreover, 4.4% of the findings have been marked as duplicates, seven times more than the number of fixes. The disparity between the claimed true positive rate and the actual outcome is significant, with only 2 of the tracked vulnerabilities having been exploited in the wild.

With the project's triage bottleneck, the findings are being dumped on open-source maintainers, leading to a high false positive rate and a small handful of low-impact bugs. This situation raises questions about the validity of Anthropic's claims and the burden placed on maintainers.