Seven months into Project Glasswing, VulnCheck has tracked 442 CVEs attributable to Anthropic, roughly 0.5% of all CVEs published this year, with only two identified as exploited in the wild. Of Anthropic’s 37,966 reported findings, only 7,349 (19.4%) have been made public and just 217 have been marked fixed.
A place I worked at fell for this AI marketing doomerism around vulnerabilitues hook line and sinker. The tool lit up the organisation’s infrastructure like a Christmas tree labelling thousands of configuration issues and potential exploits, yet only a tiny fraction of was ever truly exploitable from the open internet. Millions blown on this junk and hundreds of hours wasted triaging meaningless reports all to appease an LLM that doesn’t know jack shit about threat modelling. But hey executives said scary number went down and that’s good right?
A place I worked at fell for this AI marketing doomerism around vulnerabilitues hook line and sinker. The tool lit up the organisation’s infrastructure like a Christmas tree labelling thousands of configuration issues and potential exploits, yet only a tiny fraction of was ever truly exploitable from the open internet. Millions blown on this junk and hundreds of hours wasted triaging meaningless reports all to appease an LLM that doesn’t know jack shit about threat modelling. But hey executives said scary number went down and that’s good right?