Tracking Anthropic-discovered vulnerabilities

7.1 relevance

Tracking Anthropic-discovered vulnerabilities is novel, technically deep, and highly community-engaged.

General vulncheck.com

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For platform and security engineers evaluating AI-driven vulnerability discovery tools, this analysis reveals a massive gap between reported findings and actionable fixes, plus questionable true positive rates that shift validation burden onto open-source maintainers.

Key Takeaways

Treat AI-discovered vulnerability claims with skepticism until independently verified, and budget for the maintainer overhead of triaging false positives from automated scanners.

Tracking Anthropic-discovered vulnerabilities

Summary

Seven months into Project Glasswing, VulnCheck has tracked 442 CVEs attributable to Anthropic, representing 0.5% of all CVEs published this year, with only two exploited in the wild. Anthropic's ledger reports 37,966 findings but only 217 fixes, and its claimed 94.2% true positive rate is undermined by 1,654 duplicates and 419 withdrawn findings. The OSS Scanner shifts validation to maintainers, with curl rejecting 19 of 34 published reports as non-vulnerabilities, further questioning Anthropic's accuracy claims.