Thirty-seven thousand nine hundred sixty-six security holes is not an achievement, it is a queue, and the volunteers standing at the front of it never agreed to become the last line of defense for software running inside your bank. Seven months after Anthropic pointed Claude at the world’s most critical code, the project has produced an avalanche of findings and a rounding error’s worth of fixes, and the bill for that gap is being handed to people who work for free.
VulnCheck’s Patrick Garrity has tracked the output since launch, and his November 9 update put the ledger at 37,966 candidate vulnerabilities, 7,349 of them public, and just 217 marked fixed. VulnCheck That is the shape of a system that became extraordinary at finding problems and never became good at closing them. Discovery scaled. Remediation stayed artisanal.
The ambition at the start was enormous and honest about it. Anthropic announced Project Glasswing on April 7 with AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks alongside it, plus 40 more organizations that maintain critical infrastructure, and pledged up to $100 million in model credits and $4 million in donations to open-source security groups. Its unreleased model, Claude Mythos Preview, had found thousands of high-severity flaws, including some in every major operating system and every major web browser. Anthropic
Then the numbers arrived in a pattern nobody at the launch could have wanted. Since September, Anthropic added nearly 12,000 findings and recorded 15 additional fixes. Fifteen. There are 1,654 entries marked as duplicates and 419 withdrawn, and the company’s stated true-positive rate climbed from 90.8 percent to 94.2 percent while thousands of entries sat unread.
Claude Mythos — It Finds Zero-Day Vulnerabilities Faster Than Anyone Can Read Them
The finding half genuinely works, which is what makes the rest so uncomfortable. Mythos reads a codebase the way a gifted human researcher does, following commit history for a bounds check that was added somewhere and never added everywhere, then testing what the surviving code does when handed the wrong input. Pointed at projects that have absorbed millions of hours of fuzzing, it kept pulling out high-severity bugs.
That is a real capability, and it arrives on a schedule no industry was prepared for. Anthropic’s own answer, launched October 8, was to stop pretending the review bottleneck could be absorbed internally. It built a scanner that open-source maintainers can sign up for and let Claude examine their repositories directly, sending reports straight to the people who have to fix them. The queue did not shorten. It was rerouted, from a company with thousands of employees to individuals who have day jobs.
Garrity’s audit of the first results has the texture of a warning. Of 34 curl reports published under the new arrangement, 19 were judged not to constitute vulnerabilities at all, six were confirmed low severity, and nine were still awaiting assessment. One in five of the confidence scores survived contact with a human who knows the code.
Daniel Stenberg — 45 Reports Landed at Once, and His Goal Was Not to Drown
curl is a small program that fetches things across a network, and it is installed in a quantity of places best described as everywhere: phones, cars, televisions, banks, hospital systems, the servers that move money between them. It has been maintained for three decades by one man, Daniel Stenberg, who marked the project’s thirtieth anniversary this week. Daniel Stenberg
At the beginning of November, one delivery dropped 45 vulnerability reports on him. His stated aim, written plainly before that package arrived, was to avoid drowning in the volume. The response was not a press release. It was a change to the project’s security process: low and medium severity reports now get discussed in public on GitHub, because the only capacity left to review them is the community’s. 36Kr
Read that again as a management decision. A volunteer maintainer of the internet’s plumbing concluded that the sane way to handle a corporate AI program’s output was to open the floodgates and hope enough strangers show up with shovels. Thirty years of careful stewardship, and the reward is an inbox that requires a triage policy.
He is not the story because he complained. He is the story because he is the reliable adult in a system that just discovered it can generate more work than it can absorb, and his answer was to make the work public instead of quiet.
Patrick Garrity — The Fix Counter Moved 15 Times While Discovery Added 12,000
Garrity’s own figures run lower than Anthropic’s in one direction and higher in another, and the disagreement is the point. He counts 442 CVEs attributable to Anthropic, roughly 63 a month, about half of one percent of the 93,450 CVEs published this year. Anthropic’s ledger, meanwhile, shows different totals on a different counting method, and the company places its own tallies at 6,376 findings reviewed by outside experts, 6,009 confirmed valid, 5,087 reported to maintainers, and 629 that earned an upstream patch.
Both sets say the same thing about direction. Whatever the true fix count is, it is not keeping pace with the find count, and the gap widened sharply in the last two months.
The one number that undercuts the doom marketing is this: only two of those 442 have been exploited in the wild. Half a percent. A model that can find thousands of latent flaws has not, so far, handed attackers thousands of working weapons, which is exactly what you would expect when most of what it finds is low severity or duplicate.
So the danger is not a wave of exploits this quarter. The danger is the debt: tens of thousands of unverified findings piled on maintainers who cannot process them, a review pipeline that converts volunteer hours into triage labor, and a discipline that rewards the announcement of a discovery far more than the unglamorous decade of maintenance that follows it. This is what AI-mekna does when it is pointed at a problem measured in human attention rather than compute.
Anthropic — A 90-Day Window Was Built for Humans Doing the Finding
The sharpest admission comes from Anthropic itself, buried in the research write-up rather than the launch page: the industry’s 90-day disclosure convention may not survive contact with the speed and volume of machine-found bugs. That is the company conceding that a norm built for human researchers working at human pace has no answer for a finder that does not sleep.
What is missing is the matching commitment on the other side. Four million dollars of donations against a burden counted in the evenings and weekends of people like Stenberg is not a repair, it is a gesture with a press release attached. The hundred million in credits buys scanning. Nobody is funding the reading.
Anthropic deserves credit for building the thing and for publishing numbers that let outsiders grade it. It also built a machine that produces homework faster than the class can do it, and then handed the stack to the students.
Axel’s Take — The Bug Was Never the Expensive Part
Here is the arithmetic the launch deck left out. Every candidate finding is a small human obligation: read the code, reproduce the crash, judge severity, write the fix, argue with the reporter, ship the release. Multiply that by 37,966 and you have a decade of unpaid work created in seven months, assigned to the least resourced people in the software economy, and celebrated as a triumph of safety.
The uncomfortable symmetry is that the same capability that drowns a maintainer is the only realistic defense against the next attacker who has it. Anthropic’s own framing is right about that: these capabilities will proliferate, and defensive use has to get ahead of offensive use while the window is open. Which means the fix cannot be to slow the finding down. It has to be to fund the fixing, or to automate it, or to accept that we have created a permanent triage class and start paying them.
None of that happened in the first seven months. What happened is that one man marked thirty years of a project he built, took delivery of 45 bug reports in a single batch, and rewrote his own rules so strangers could help him stay afloat. The internet runs on that. It has always run on that. The difference now is that the supply of problems has become industrial while the supply of people who can close them has not moved at all.
Sources: VulnCheck, Anthropic, 36Kr, Daniel Stenberg.