A deep dive into Anthropic's Project Glasswing reveals a staggering gap between AI-generated vulnerability findings and actual remediation, highlighting a critical human bottleneck in cybersecurity.
- Claude Mythos identified 26,153 vulnerabilities, but only ~10% reached the disclosure stage.
- Less than 0.8% (only 202) of the AI-generated flaws have been successfully patched.
- A significant disparity exists between AI's severity ratings and those assigned by human maintainers.
A recent analysis of public data from Anthropic’s Project Glasswing has exposed a critical disconnect in the AI-driven security pipeline. While the Claude frontier model is capable of generating thousands of potential vulnerability findings, the process of validating and fixing these flaws remains stubbornly manual and slow.
Patrick Garrity, a security researcher at VulnCheck, scrutinized the Vulnerability Disclosure Ledger. His findings show that since April 2026, Claude Mythos flagged 26,153 vulnerabilities. However, only 2,736 of these—roughly 10%—ever made it to the disclosure ledger. Even more alarming is the remediation rate: only 202 vulnerabilities (0.8%) have been patched to date.
Why This Matters
BozokMedia analysis shows that the industry is entering a phase of 'discovery inflation.' When AI can find thousands of potential bugs for a few hundred dollars in API credits, the value shifts from the 'find' to the 'fix.' The bottleneck is no longer the intelligence of the model, but the bandwidth of the human engineers required to triage the noise from the actual threats.
"The world is still doing security at human speed, while AI is generating vulnerabilities at machine speed."
The analysis also challenges Anthropic's claims regarding accuracy. Garrity noted that Claude was far more aggressive in assessing severity than the actual software maintainers. While the AI categorized 91.5% of findings as 'critical' or 'high,' the maintainers only agreed with this assessment in 61.3% of cases, suggesting a lack of alignment with industry standards like CVSS metrics.
This trend is mirrored in findings from Contrast Security. Founder Jeff Williams reported that different AI scanners often produce wildly different results on the same codebase. In one test, three different AI scanners agreed on only 5% of the total findings, proving that AI consistency remains a major hurdle.
| Metric | AI-Generated Claim | Human-Verified Result |
|---|---|---|
| Total Findings (Glasswing) | 26,153 | ~2,736 (Disclosed) |
| Severity Rating (High/Critical) | 91.5% | 61.3% |
| Remediation Rate (Patched) | - | < 0.8% |
The scale of this challenge was evident in Microsoft's recent September Patch Tuesday, which saw 974 vulnerabilities addressed. As AI continues to accelerate the discovery of flaws, the pressure on remediation teams will only intensify.
Frequently Asked Questions
1. What is Project Glasswing?
It is an initiative by Anthropic using the Claude AI model to identify vulnerabilities in software projects at scale.
2. Why is there a bottleneck in fixing AI-found bugs?
Because AI produces a high volume of 'potential' findings (noise), and human experts must manually verify each one before a patch can be developed.
