Many MindedAI bug-hunting is producing findings far faster than fixes
VulnCheck, a commercial vulnerability intelligence vendor, has been tracking CVEs attributable to Anthropic since April 17, ten days after Project Glasswing launched on April 7. Over roughly seven months it has counted 442, about 63 a month and around 0.5% of the 93,450 CVEs published this year. Only two of them, CVE-2026-61500 and CVE-2026-26980, appear in VulnCheck's KEV list as exploited in the wild.
Anthropic's public ledger, last updated November 2, lists 37,966 findings. Of those, 7,349 (19.4%) are public and 217 are marked fixed. Between September 8 and November 2, findings rose by 11,813 while fixes rose by just 15. The ledger also shows 1,654 duplicates and 419 withdrawn findings. Its claimed true positive rate has climbed from 90.8% at its May launch to 94.2%.
The quality picture is mixed. Anthropic's October 8 OSS Scanner post said it sent nearly 5,000 unverified, fully model-generated reports to maintainers, and that some may be invalid. Of 34 published curl reports, 19 were marked not a vulnerability, 6 were confirmed low severity and 9 await assessment. In September, Claude rated 91.5% of findings critical or high, against 51.3% from maintainers.
For abundance, the promise is cheaper security: machines finding flaws at scale could cut the cost of hardening shared code. The numbers suggest the constraint is moving to triage, disclosure and patching, which still depend on scarce maintainer time.
Caveats: VulnCheck sells competing intelligence products and is openly skeptical. It says the ledger has a bug inflating disclosed counts, and the reason for the rising true positive rate is its speculation. The curl data is partial, and the ledger updates only in infrequent batches.
Source: Hacker News