Audit of Glasswing uncovers 38,000 AI-found vulnerabilities, 217 fixed.
anthropic
| Source: Dev.to | Original article
An independent audit of Anthropic’s “Glasswing” bug‑discovery machine has revealed the sheer scale of AI‑generated security findings. The review catalogued 37,966 vulnerabilities uncovered by the system, of which 7,349 have been made public. So far, developers have addressed 217 of those issues.
The audit confirms Anthropic’s claim from seven months ago that its models can surface “thousands of high‑severity” bugs. Glasswing’s latest scanner, rolled out in October, automatically composes full‑report emails to maintainers and sends them without any human vetting. In practice, the approach has produced mixed results. The maintainer of the widely used curl library received 45 reports; only six were confirmed as low‑severity problems.
Why it matters is twofold. First, the numbers demonstrate that large‑language models can operate at a volume far beyond traditional manual code reviews, potentially accelerating the hardening of open‑source ecosystems. Second, the low confirmation rate and the absence of human triage raise questions about the efficiency of fully automated reporting and the risk of alert fatigue among maintainers.
Going forward, the community will be watching whether Anthropic refines Glasswing’s filtering to raise the proportion of actionable findings, and whether other security teams adopt similar AI‑driven pipelines. The audit’s live tracker, which charts month‑by‑month trends and highlights top‑affected products, will provide a barometer for the tool’s evolution and its real impact on software security.
Sources
Back to AIPULSEN