“There's a big difference between finding vulnerabilities and whether they're actually useful to and will be used by threat actors,” Patrick Garrity told The Register — and his data makes that distinction concrete: 225 CVEs linked to Anthropic or Project Glasswing, and just one exploited in the wild (CVE-2026-26980).
Patrick Garrity’s Anthropic CVE tracker
VulnCheck researcher Patrick Garrity began tracking CVEs attributed to Project Glasswing shortly after Anthropic announced the program in April. Garrity’s tracker maintains a list of vulnerabilities credited to the Anthropic team and/or Project Glasswing and checks those CVEs against the company's known exploited vulnerabilities index “to get a better read on the real Glasswing ‘danger factor.’”
As of Monday, Garrity counted 225 CVEs linked to Anthropic or Glasswing. He reported that fewer than 0.5 percent of those vulnerabilities are being “battered in the wild.” His core observation: discovery does not equal weaponization.
Project Glasswing and Claude Mythos Preview access
Anthropic launched Project Glasswing to give select partners access to its Claude Mythos Preview model. In April, Anthropic said the new model was too risky to release publicly because its bug-finding and exploitation skills “surpass all but the most skilled humans.” As a result, Anthropic restricted Mythos Preview access to vetted Glasswing participants who use the model for defensive security work, including finding and fixing flaws in their own software products and open source dependencies.
Anthropic didn’t immediately respond to questions for Garrity’s coverage; the original story noted it would be updated if Anthropic replied.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleReal-world exploitation: one notable exception
Of the 225 CVEs tracked, only one has been observed exploited in the wild: CVE-2026-26980, a critical SQL injection vulnerability in Ghost. Garrity contrasted the volume of AI-aided discovery with the very limited real-world exploitation, saying, “The main thing this data highlights is that what Anthropic is discovering and disclosing is fairly limited in impact, and from what we can tell, isn't resulting in different outcomes from a threat perspective than a random selection of other vulnerabilities would.”
He placed the Anthropic-linked numbers in historical context, noting that historically “that's ranged from just under one percent to two percent of vulnerabilities that get weaponized and used in the wild.”
AI can find bugs — but fixes still need people
Garrity does not dispute AI’s ability to surface vulnerabilities; the recent flurry of security disclosures and “massive patch drops” from Microsoft, Apple, Palo Alto Networks and various open source projects illustrate that models are bringing more flaws to light. But several studies cited in the coverage underscore the gap between discovery and dependable remediation.
- 1Password’s research team produced and analyzed 6,080 patches generated by two frontier models — OpenAI's ChatGPT-5.5 and Anthropic's Opus 4.8. The models fully resolved the vulnerability just 26 percent of the time; about 54 percent either failed to resolve the vulnerability, introduced a new vulnerability, or did both.
- Veracode found that, across more than 100 models and 80 coding tasks, the average security pass rate for AI-generated code was 56 percent.
“The bar for vulnerability discovery is much lower with AI, but the real gap lies downstream in coordination, triage, remediation, and patch deployment, which is still largely people-intensive work, as Anthropic itself has acknowledged,” Garrity said. “It appears they might not have realized this until after they launched the project.”
What this means for technologists, policymakers, and threat actors
- Technologists and security teams: Expect more AI-driven vulnerability reports, but plan for human-intensive triage and remediation work — model-generated fixes have shown limited success and can introduce new flaws.
- Policymakers and regulators: Metrics that separate discovery counts from known-exploited vulnerabilities (such as the index Garrity uses) will matter when assessing operational risk from AI-assisted research.
- Adversaries and threat actors: So far, attackers have largely “shrugged” — only one Anthropic-linked CVE has been observed exploited; historical weaponization rates remain below a few percent.
The record as presented is straightforward: Anthropic-linked tooling has surfaced hundreds of CVEs, but observable exploitation remains rare — one critical SQL injection in Ghost among 225 entries — while independent studies show AI fixes are often incomplete or unsafe. The pointed practical question Garrity’s data raises is also operational: can triage, remediation and patch deployment scale to match the lower bar for automated discovery? Anthropic’s public silence on those questions, at least for now, leaves that next step unresolved; the story will be updated if the company responds.
