Anthropic Glasswing Exposes AI Vulnerability Discovery-to-Remediation Gap

Anthropic's Project Glasswing reportedly generated 26,153 open-source vulnerability findings, but public disclosure records show a far smaller number progressing through validation and remediation. Public coordinated-vulnerability-disclosure cards across eight projects document 12 CVEs and five GHSAs—including three critical and seven high-severity cards—while attributing the accepted work to Glasswing without identifying a specific Anthropic model in most cases. Only CVE-2026-4747 has separate primary-source attribution to Mythos.

The disparity illustrates that AI-assisted discovery can outpace human triage, patch authoring, maintainer review, and enterprise deployment. Anthropic's public ledgers reportedly reflected about 202 fixed vulnerabilities after five months, while Trail of Bits and OpenAI's Patch the Planet found 1,646 issues in 59 codebases but had only 215 merged patches as of September 4. Organizations should expect larger vulnerability queues and prioritize remediation using evidence of exploitation, asset reachability, compensating controls, and business exposure rather than CVSS scores alone.