Anthropic AI finds thousands of software flaws but few are being fixed

The discovery-remediation gap

Anthropic's Project Glasswing is a cybersecurity initiative designed to use artificial intelligence to identify software vulnerabilities. While the project has been successful at finding flaws, new research highlights a growing disconnect between discovery and action. As of November 2, the initiative had recorded 37,966 potential vulnerabilities, yet the progress on fixing them has been notably slower.

A recent analysis by researcher Patrick Garrity examined Anthropic’s public records to see if these AI-powered efforts were creating real-world improvements. The data shows that only 7,349 findings, or 19.4%, appeared in the company's public disclosure ledger. Out of those, Garrity found only 217 entries marked as fixed, while identifying approximately 1,654 duplicates and 419 withdrawn findings.

The disparity became even more apparent when looking at a specific timeframe. Between September 8 and November 2, the total number of findings grew by 11,813. During that same period, the number of findings marked as fixed rose by just 15. This suggests that while the AI can find problems at a high velocity, the human infrastructure required to repair them is struggling to keep pace.

Accuracy and validation hurdles

Anthropic has stated that its models achieve a 94.2% true-positive rate for vulnerabilities assessed by external security firms. However, this figure is based on a reviewed subset of findings rather than the entire pool of 37,966 candidates. This distinction is important because the subset may exclude many of the duplicates or findings deemed unsuitable for fixing.

The research raises questions about whether the company's reported accuracy fully reflects the reality of the work. Because the AI generates such a high volume of reports, many are eventually discarded as duplicates or withdrawn. If the

Impact on open-source tools

The practical burden of AI-generated reports is becoming visible for developers of popular software. For example, the widely used data transfer tool curl recently received 45 different vulnerability reports from Anthropic. This influx of data forces maintainers to spend significant time manually assessing each submission to determine its validity.

Curl maintainer Daniel Stenberg has already warned about this growing volume of reports. This pressure was significant enough that the project had to change its internal procedures for handling low- and medium-severity submissions. While Anthropic did successfully identify a significant vulnerability in curl that was fixed in October, the sheer volume of reports remains a concern for community-led projects.

New tools and shifting burdens

Anthropic has acknowledged that it is currently constrained by human capacity to validate the massive amount of vulnerabilities its models can discover. To address this, the company announced an opt-in vulnerability scanning service for open-source maintainers. This new OSS Scanner is designed to provide findings more quickly by bypassing some of the independent human review typically performed by the company.

While this move aims to speed up the disclosure process, it creates a new challenge for the software developers involved. By removing the company's internal review step, the responsibility for assessing and prioritizing the findings is transferred to the development teams. These teams are often already stretched thin and may find it difficult to manage the additional workload of verifying AI-generated data.

The industry-wide validation hurdle

The situation with Project Glasswing points to a broader challenge emerging across the entire cybersecurity landscape. As artificial intelligence dramatically accelerates the speed at which software flaws can be discovered, the industry is facing a new bottleneck. Organizations now need to develop equally effective methods to verify, prioritize, and remediate the weaknesses that these models identify.

Without these capabilities, the rapid discovery of bugs risks overwhelming the people responsible for turning those discoveries into actual security protections. The research suggests that the value of AI in security is currently high, but its utility is limited by the human capacity to act on the information it provides. The industry must find a way to balance high-speed discovery with manageable, high-quality remediation.