Claude Found 23,019 Vulnerabilities. The Only Number That Mattered Was 90.6%
Anthropic's Project Glasswing scanned 1,000+ open-source projects and surfaced 23,019 issues. Then six independent firms graded a sample — and that step, not the scan, is the one that turns agent output into something you can act on.
NeuroX AI · July 17, 2026
Anthropic's Project Glasswing pointed a frontier model at more than 1,000 open-source projects and came back with 23,019 issues, including an estimated 6,202 high- or critical-severity vulnerabilities. A headline number that big is exactly the kind of thing that gets a demo a standing ovation and gets a security team nowhere.
Then came the part that matters. Six independent research firms hand-assessed 1,752 of the high-severity findings. 90.6% held up as real — and 62.4% were confirmed at the severity the model claimed. Only after that pass could Anthropic responsibly project ~3,900 genuine high- or critical-severity bugs. The scan produced volume. The verification produced a number you can defend.
This is the whole game, and it has nothing to do with security. Any agent can generate 23,000 of anything. Raw output is free now. The scarce, expensive, production-grade asset is the confirmed subset — the findings that survived an adversary trying to prove them wrong. A generation-only pipeline hands you 23,019 tickets and makes triage your problem. A disciplined one tells you which 3,900 are worth your week.
Most teams ship the scanner and skip the grader, then wonder why nobody trusts the agent's output. The confirmation loop isn't overhead. It's the product.