Project Glasswing at Seven Months: 37,966 Findings, 2 Exploited, Claimed vs Verified

VulnCheck says Anthropic's Project Glasswing has produced a very large findings ledger but few exploited vulnerabilities: 2 of 442 attributed CVEs. In a review dated November 9, 2026, analyst Patrick Garrity compared Anthropic's public disclosure ledger (37,966 findings as of November 2) with the CVE records that actually credit Anthropic. For anyone who runs AI coding agents, the useful takeaway is not who is right about the hype. It is that "AI found it" tells you almost nothing about whether you need to patch tonight.

What is Project Glasswing, and what did VulnCheck count?

Project Glasswing is Anthropic's program for using its restricted Mythos-class model to find bugs in software, with vetted organizations and a public disclosure ledger. Beam has covered adjacent news, including Mythos behind Cisco and IBM products and Mythos rediscovering known CVEs in coding-agent scenarios.

VulnCheck's methodology, as it describes it:

• It has tracked CVEs attributed to Anthropic since April 17 in an open repository, drawing on CVE records, GitHub advisories, Linux kernel commits and Anthropic's ledger, plus manual audits for missed credits.
• It checked those CVEs against its own KEV catalog of exploited vulnerabilities.
• Ledger figures come from Anthropic's public ledger, last updated November 2, which updates in infrequent bulk batches.

Claimed vs verified

Between September 8 and November 2 the ledger grew from 26,153 to 37,966 findings and the public share from 10.5% to 19.4%. Fixes only moved from 202 to 217, while withdrawn items rose from 245 to 419 and duplicates from 2 to 1,670. VulnCheck's argument is that a rising claimed true-positive rate is hard to reconcile with those columns. VulnCheck's post gives the duplicate count as 1,654 in its text and 1,670 in its table; 4.4% of 37,966 matches the table, so this post uses 1,670.

Which two CVEs were exploited?

VulnCheck names CVE-2026-61500 and CVE-2026-26980 but does not describe them. The second one we can check. CVE-2026-26980 is a critical (CVSS 3.1 score 9.4) SQL injection in the Content API of the Ghost publishing platform. According to the GitHub advisory, unauthenticated attackers can read arbitrary data from the database in Ghost v3.24.0 through v6.19.0. The fix is v6.19.1, and the advisory credits "Nicholas Carlini using Claude, Anthropic" for the report. Ghost recommends reviewing staff users and rotating keys because the flaw exposes API keys; there is no application-level workaround, though a WAF rule blocking slug:[ filters can help temporarily.

I did not find a Beam CVE page or other primary description for CVE-2026-61500, so what it affects is unconfirmed here.

This matters because it shows both halves of the story. Model-assisted research did surface a real, exploited, critical bug. And the exploited count is still tiny next to the ledger size.

The curl data point

The sharpest evidence in the audit comes from curl. In May, Daniel Stenberg wrote about a Mythos scan of curl: the report listed five "confirmed security vulnerabilities", and after several hours of review the team kept one, rated low severity. Three were false positives about behavior documented in the API and one was "just a bug". The scan, run by a third party through the Linux Foundation's Alpha Omega project, found no memory-safety vulnerabilities. Stenberg also said AI analyzers are "significantly better" than traditional ones, and that projects not scanning with AI probably have undiscovered flaws.

VulnCheck's November update adds the later batch. Curl received 45 reports from Anthropic, one rated medium and the rest low. Of the 34 published so far, VulnCheck says 19 (55.9%) were not vulnerabilities, 6 (17.6%) were confirmed low severity, and 9 await assessment. Those 9 can move the percentages, and this is a single project.

Why the triage load matters

VulnCheck quotes Anthropic's October 8 post: more than 29,000 candidate vulnerabilities, about 6,000 manually reviewed, and Anthropic "bottlenecked on our human capacity to validate these findings". It had sent nearly 5,000 unverified reports to maintainers, and its self-service OSS Scanner lets projects triage model-generated reports themselves, with a warning they may be incorrect. VulnCheck's reading is that the bottleneck moved to maintainers. That is its interpretation; Anthropic describes the scanner as an opt-in tool.

Timeline of what is documented

• April 7, 2026: Glasswing launches, per VulnCheck's seven-month framing. VulnCheck begins tracking Anthropic-credited CVEs on April 17.
• May 2026: The ledger launches with 23,019 findings and a claimed 90.8% true-positive rate, according to VulnCheck. Stenberg publishes his curl write-up on May 11.
• September 8: 26,153 findings, 2,736 public, 202 fixed, 245 withdrawn.
• October 8: Anthropic's post on the OSS Scanner reports more than 29,000 candidates and a human-validation bottleneck, as quoted by VulnCheck.
• November 2: 37,966 findings, 7,349 public, 217 fixed, 419 withdrawn, 1,670 duplicates.
• November 9: VulnCheck publishes its review.

Read as a series, the ledger grows by thousands of findings between snapshots while fixes move by about fifteen. That gap is the heart of VulnCheck's argument, and it is also the part most sensitive to disclosure timing: findings embargoed for coordinated disclosure would not show as fixed yet.

How to read a "tens of thousands of findings" claim

Four different quantities get blurred in headlines, and each answers a different question for a developer:

1. Findings or candidates: model output, mostly unreviewed. Useful to a maintainer who opts in, meaningless to a user deciding what to patch.
2. Confirmed vulnerabilities: a human agreed the bug is real. The curl numbers show this can be a minority of what a model reports.
3. CVEs: a public identifier exists. Here VulnCheck counts 442, a small fraction of the ledger.
4. Exploited CVEs: someone is using the bug. This is the number that should drive urgency, and here it is two.

Each step down loses most of the volume. That is normal for any scanner, human or model, and it does not mean the early steps are worthless: Stenberg's point was that AI analyzers find real bugs that older tools miss. It does mean a raw findings count is a poor guide to your risk. When you see a big number from any vendor, ask which of the four it is.

Caveats on the audit itself

• VulnCheck sells vulnerability intelligence, including the KEV catalog it checked against, and its framing is that launch claims are unsupported. Read it as an informed critique, not a neutral ruling.
• Exploitation status depends on one catalog. A CVE missing from KEV may still be exploited.
• Attribution counts rest on VulnCheck's tracking method.
• Seven months is early; many findings may still be in the disclosure pipeline, as the 19.4% public figure suggests.
• Other outlets report different totals (for example 26,153 or 23,019), which are likely earlier snapshots. Compare dates before comparing numbers.

What this means if you run AI coding agents

1. Patch on exploitation evidence. A vulnerability's origin (human, fuzzer or model) does not change your exposure. Use CISA KEV, vendor advisories and your own inventory. Beam's recent coverage of exploited CVEs, such as Chrome CVE-2026-125350 and React Server Components CVE-2026-126187, follows that logic.
2. Expect a noisier stream. If your agent runs dependency audits or opens security PRs from model-generated findings, budget for false positives. A related result: AI auditors catch most agent misbehavior but flood reviewers with false alarms.
3. Check self-hosted apps. If you run Ghost, confirm the version is 6.19.1 or newer, review staff users and rotate keys. Check with npm ls ghost in a Node install, or the admin panel's version.
4. Do not let an agent auto-merge security fixes. Require a human to confirm that a reported bug is real before changing production code.
5. Track the claims, not the headline. The same pattern of large, unverified numbers shows up in other posts, such as Mythos AMD MI355X port claims vs verified.

What Beam can and cannot do here

Beam does not scan for CVEs in your applications, and nothing in this story changes how it works. What applies is the local layer: Beam watches what Claude Code and Codex do on your machine, flags risky actions such as credential exposure or destructive commands, and can deny them through PreToolUse hooks. See how Beam works and what stays local. That deny is hook-based, not a kernel sandbox, and its skill and MCP scanning is heuristic. It helps if an agent that is acting on a mistaken finding tries something destructive; it will not tell you whether the finding is real.

Related reading

• November 2026 attacks timeline
• Mythos in Cisco and IBM products
• Mythos CVE rediscovery in coding-agent scenarios
• Beam CVE database entry for CVE-2026-26980

Frequently asked questions

How many exploited vulnerabilities came out of Project Glasswing?

VulnCheck says 2 of 442 CVEs it attributes to Anthropic, about 0.45%, appear in its KEV catalog: CVE-2026-61500 and CVE-2026-26980. That is VulnCheck's count from its own tracking, not an Anthropic figure.

Is the 37,966 number the same as 37,966 vulnerabilities?

No. It is the number of findings in Anthropic's public ledger as of November 2. Per VulnCheck, only 7,349 (19.4%) were made public, 217 are listed as fixed, 419 withdrawn and 1,670 flagged as duplicates.

Does the audit prove Glasswing does not work?

No. It shows that findings, CVEs and exploitation are very different counts, and that triage is slow. Real fixes exist, including a critical Ghost SQL injection credited to Nicholas Carlini using Claude. The audit's author also sells vulnerability intelligence.

What should I do as someone running coding agents?

Patch based on exploitation signals (CISA KEV, vendor advisories), not on how a bug was found. Keep agents on updated toolchains, pin dependencies, and review what your agent installs or runs.

Did curl confirm Mythos findings?

In May, Daniel Stenberg kept one low-severity vulnerability out of five reported as confirmed. VulnCheck says that of 34 later-published reports, 19 were not vulnerabilities and 6 were confirmed low severity, with 9 pending.

Figures are accurate as of November 12, 2026, based on VulnCheck's November 9 review and Anthropic's ledger as of November 2. Ledger numbers change with each bulk update; Beam will revise this post if VulnCheck or Anthropic publish corrections.