After 7 Months, Glasswing Overwelms Maintainers with Underwhelming Findings
Summary
The article analyzes seven months of Anthropic's Glasswing vulnerability disclosures, revealing 442 CVEs attributed to Anthropic (about 0.5% of all CVEs this year) with only 2 exploited in the wild. It critiques the ledger's numbers, the high rate of duplicates and withdrawals, and the shift of triage burden to maintainers via the OSS Scanner, questioning the claimed true positive rate and overall effectiveness of the disclosure program.