A tracker cited by The Register counts 225 vulnerabilities linked to Anthropic or Project Glasswing, yet only one has confirmed exploitation in the wild. The finding complicates the loudest claims about AI-powered bug hunting: discovering more flaws does not automatically mean attackers can turn them into more attacks.
Anthropic Watch analysis
What happened
The Register reports that VulnCheck researcher Patrick Garrity has tracked vulnerabilities attributed to Anthropic’s Project Glasswing, which gives selected partners access to the Claude Mythos Preview model for defensive security work. Anthropic introduced the programme after saying the model’s bug-finding and exploitation skills were too risky for public release.
As of 21 September, Garrity’s tracker listed 225 linked vulnerabilities. The Register says one, a critical SQL injection flaw in Ghost, has confirmed exploitation in the wild. Garrity told the publication that the results so far do not show a different threat outcome from a random selection of vulnerabilities.
That is a useful distinction. AI may lower the effort needed to find bugs, but a discovered weakness still needs to be weaponised, prioritised, fixed and deployed. The supplied report says Anthropic did not immediately respond to The Register’s questions.
Key findings
- 225 linked vulnerabilities
VulnCheck’s tracker attributes this many flaws to Anthropic or Project Glasswing as of Monday. - One confirmed exploitation
The Register identifies a critical Ghost SQL injection flaw as the only case confirmed in the wild. - Finding is not fixing
The report cites research in which frontier models fully resolved a vulnerability only 26% of the time. - Human-heavy remediation
Triage, co-ordination, patch deployment and checking whether a fix actually works remain practical bottlenecks.
Why it matters
Security teams should not treat a rising count of AI-discovered vulnerabilities as a direct measure of rising criminal impact. The more immediate pressure may fall on defenders, who must sort a larger stream of findings and decide which deserve urgent attention.
The report also highlights a less glamorous weakness in the AI security story. Models may be getting better at spotting defects, while the harder work of producing safe patches and getting them into production remains stubbornly dependent on people. The robot can hand over a shopping list. Someone still has to fix the plumbing.
Our read
This is a valuable reality check, not a clean bill of health. The evidence supports a narrower conclusion than “AI has unleashed attackers”: AI-assisted discovery is increasing, but confirmed exploitation remains rare in this dataset. That may change, and defenders should prepare for it, but the current numbers do not justify skipping the middle steps.
What to watch
- Whether the number of Glasswing-linked vulnerabilities continues to grow.
- Whether more of those flaws appear on known-exploited vulnerability lists.
- Independent testing of AI-generated security patches.
- How Anthropic describes the programme’s remediation and disclosure process.
Discussion spark: If AI makes vulnerability discovery dramatically cheaper, should security teams prioritise fixing the largest volume of findings, or only the flaws with clear evidence of real-world exploitability?
Sources and evidence
- Anthropic-linked CVEs pile up, attackers mostly shrug – The Register (21 September 2026, 22:32 UTC)
Anthropic Watch is independently operated by WittyWires. It is not affiliated with, endorsed by, or operated by Anthropic.