Few AI-found bugs from Anthropic's Glasswing get exploited

Fewer than 0.5 percent of the vulnerabilities credited to Anthropic or its Project Glasswing programme are being exploited in the wild, according to VulnCheck security researcher Patrick Garrity, whose tracking figures were reported by The Register on 21 September 2026. As of that Monday, the count stood at 225 CVEs, of which one \u2014 a critical SQL injection flaw in the Ghost publishing platform, tracked as CVE-2026-26980 \u2014 has been exploited by attackers.

Project Glasswing is Anthropic's initiative giving selected partners access to its Claude Mythos Preview model. Anthropic announced the programme in April, saying at the time that the model was too risky to release publicly because its bug-finding and exploitation skills surpassed all but the most skilled humans. Access was restricted to vetted participants who use the model for defensive work, including finding and fixing flaws in their own products and in open source dependencies.

Garrity began tracking CVEs attributed to the programme shortly after it was announced. His tracker lists vulnerabilities credited to the Anthropic team or to Glasswing and cross-checks them against VulnCheck's known exploited vulnerabilities index, in his words to get a better read on the real Glasswing \u201cdanger factor\u201d.

\u201cThere's a big difference between finding vulnerabilities and whether they're actually useful to and will be used by threat actors,\u201d Garrity told The Register. He said the data suggests what Anthropic is discovering and disclosing is fairly limited in impact, and is not producing different outcomes from a threat perspective than a random selection of other vulnerabilities would.

Anthropic did not immediately respond to The Register's questions.

Garrity said he does not dispute that AI models can find bugs, and noted that the capability is not unique to one model or harness. The Register pointed to recent large patch drops from Microsoft, Apple and Palo Alto Networks, as well as open source projects, as evidence that AI is surfacing more flaws than before.

The researcher's argument is about base rates. \u201cA lot of the hysteria we're seeing assumes that every vulnerability or bug is likely to be used by threat actors,\u201d he said. \u201cBut the reality is that only a small fraction ever get used in exploitation campaigns. Historically, that's ranged from just under one percent to two percent of vulnerabilities that get weaponized and used in the wild.\u201d

The Register also cited two studies suggesting models are better at finding flaws than repairing them. 1Password's research team produced and analysed 6,080 patches generated by two frontier models, OpenAI's ChatGPT-5.5 and Anthropic's Opus 4.8. The patches fully resolved the vulnerability 26 percent of the time, while about 54 percent either failed to resolve it, introduced a new vulnerability, or both. A separate study by application security firm Veracode looked at more than 100 models across 80 coding tasks and found an average security pass rate for AI-generated code of 56 percent.

Garrity said the practical bottleneck sits after discovery. \u201cThe bar for vulnerability discovery is much lower with AI, but the real gap lies downstream in coordination, triage, remediation, and patch deployment, which is still largely people-intensive work, as Anthropic itself has acknowledged,\u201d he said, adding that it appears the company might not have realised this until after launching the project.