Summary
- VulnCheck researcher Patrick Garrity has tracked 225 CVEs attributed to Anthropic and Project Glasswing since April; only one has been exploited in the wild.
- Historically, just one to two percent of all disclosed vulnerabilities are ever weaponised — AI-discovered bugs appear to follow the same pattern.
- AI models remain poor at fixing bugs they find: a 1Password study found frontier models fully resolved vulnerabilities only 26% of the time.
- A Veracode study across more than 100 models found an average security pass rate of just 56% for AI-generated code.
- The downstream work of triage, remediation, and patch deployment remains largely human-intensive, regardless of how bugs are discovered.
The concern and the context
When Anthropic launched Project Glasswing in April, it came with a significant caveat: the Claude Mythos Preview model underpinning the initiative was considered too capable to release publicly. Anthropic’s stated reasoning was that the model’s bug-finding and exploitation skills exceeded all but the most skilled human researchers. Access was restricted to vetted partners conducting defensive security work — finding and fixing flaws in their own software and open source dependencies. That framing, understandably, raised eyebrows across the security industry.
What the data actually shows
Patrick Garrity, a security researcher at VulnCheck, began tracking CVEs credited to the Anthropic team and Project Glasswing shortly after the program launched. His tracker cross-references those CVEs against known exploited vulnerability indexes to assess what he calls the real ‘danger factor’. As of this week, the tally stands at 225 CVEs. Of those, exactly one — a critical SQL injection vulnerability in Ghost, tracked as CVE-2026-26980 — has been exploited in the wild. That puts the exploitation rate at under 0.5 percent.
Not a Glasswing problem — a base rate problem
Garrity is careful not to frame this as a criticism of Anthropic’s program specifically. The more instructive point is about how vulnerabilities, in general, get used by threat actors. “There’s a big difference between finding vulnerabilities and whether they’re actually useful to and will be used by threat actors,” he told The Register. Historically, somewhere between just under one percent and two percent of disclosed vulnerabilities ever get weaponised. By that measure, the Glasswing CVE set is performing about as one would statistically expect — not better, not worse.
AI finds bugs; humans still fix them
The more operationally significant finding from Garrity’s analysis concerns remediation, not discovery. AI models have clearly demonstrated an ability to surface security flaws at scale and speed. Recent patch volumes from major vendors, including Microsoft, Apple, and Palo Alto Networks, reflect that reality. But finding a vulnerability and fixing it reliably are distinct problems, and on the latter, current models fall well short. A 1Password research effort analysed 6,080 patches generated by two frontier models — OpenAI’s ChatGPT-5.5 and Anthropic’s Opus 4.8. Those models fully resolved the underlying vulnerability just 26 percent of the time. Roughly 54 percent of patches either failed to fix the issue, introduced a new vulnerability, or managed both outcomes simultaneously.
A second data point on AI code quality
Veracode’s research adds further weight to this picture. Across more than 100 models and 80 coding tasks, the average security pass rate for AI-generated code sat at 56 percent. For security leaders making decisions about where to deploy AI tooling in their development pipelines, that figure deserves serious consideration. Passing a security check just over half the time is a meaningful liability in a production environment.
Where the real gap lies
Garrity’s assessment is measured but pointed. The bar for vulnerability discovery has dropped considerably with AI assistance. The bottleneck has shifted downstream. “The real gap lies in coordination, triage, remediation, and patch deployment, which is still largely people-intensive work, as Anthropic itself has acknowledged,” he said. He suggested Anthropic may not have fully anticipated this constraint when it launched Glasswing. Whether that is a fair reading is difficult to assess — Anthropic did not respond to questions from The Register at the time of publication.
A note on market assumptions
One broader takeaway for security leaders is the risk of conflating capability with consequence. The assumption embedded in much AI-security discourse is that every vulnerability an AI finds will, or could, be rapidly exploited. The empirical record does not support that assumption, and Garrity’s framing is useful: “A lot of the hysteria we’re seeing assumes that every vulnerability or bug is likely to be used by threat actors. But the reality is that only a small fraction ever get used in exploitation campaigns.” That does not mean AI-assisted vulnerability discovery is without risk — it means the risk profile may be more familiar than the marketing suggests.
Why it matters
For CISOs, this data serves as a useful corrective to vendor and media narratives that frame AI bug-finding capabilities as an imminent, qualitative shift in attacker advantage. The exploitation rate for AI-discovered vulnerabilities appears consistent with historical base rates, which means your existing vulnerability prioritisation frameworks — focused on exploitability, exposure, and business criticality — remain fit for purpose. The more pressing operational implication is on the remediation side: if AI tooling is being introduced into your development or AppSec workflows, the evidence suggests human review of AI-generated patches is not optional. Automation of discovery without equivalent investment in validation and remediation creates a false sense of closure on risk.
What to do now
- Do not adjust vulnerability prioritisation frameworks solely on the basis that a CVE was discovered by an AI model — exploitation base rates suggest the same triage logic applies.
- If evaluating AI-assisted patch generation tools, require evidence of fix accuracy rates before deployment; current frontier models fully resolve vulnerabilities only around 26% of the time per available research.
- Maintain human review as a mandatory step in any AI-assisted remediation workflow, given documented rates of AI-generated patches introducing new vulnerabilities.
- Monitor the VulnCheck Anthropic CVE tracker or equivalent indexes to maintain visibility over AI-attributed disclosures relevant to your software dependencies.
- When briefing boards or executives on AI-related cyber risk, anchor assessments in exploitation rate data rather than raw CVE volume or discovery capability claims.
