Finding Bugs Got Cheap. Fixing Them Didn't.

Anthropic expanded its Cyber Verification Program today into three access tiers for vetted defenders: Defense Access, Red Team Access, and Specialized Access, covering Opus 5.5, Sonnet 5.5, and Mythos 5.1, with reduced blocking classifiers for approved users. The headline number is cumulative: at least 129,000 verified software vulnerabilities from Glasswing partners between April and July 2026, plus 5,500 more from Anthropic’s own open-source scanning through October.

Hold that number next to the only dataset detailed enough to show what happens after a model flags something.

The Glasswing funnel shows where findings die

Anthropic’s Project Glasswing initial update, published 22 May 2026, decomposes a single open-source scan. It produced 23,019 findings, 6,202 rated high or critical. Of those, 1,752 were assessed by humans. The true-positive rate on that assessed subset was 90.6% (1,587 of 1,752), which is good. Severity held up less well: 62.4% (1,094 of 1,752) kept the severity the model assigned.

Then the funnel narrows hard. Anthropic disclosed 1,129 unvetted findings and 530 verified high-or-critical ones. Maintainers shipped 75 patches, 65 with public advisories, averaging about two weeks each. Anthropic’s own write-up notes maintainers asking it to slow disclosures down because they lacked the capacity to absorb them.

A 90.6% true-positive rate and a sub-1% patch rate coexist in the same dataset. The model was mostly right. Nobody had time to act on it.

The totals don’t reconcile, so cite them separately

Independent counts land in a different place from the company ones. Chris Hughes’s 3 October synthesis puts Glasswing at 26,153 found, 2,096 disclosed to maintainers, and 202 fixed, a 0.8% fix rate. He also flags a severity-perception gap: Claude rated 91.5% of findings critical or high, while maintainers agreed on 51.3%. Back in April, VulnCheck audited CVE attribution and found 40 CVEs credited to Anthropic researchers, with exactly one (CVE-2026-4747) explicitly tied to Glasswing.

These figures span different scopes, channels, and cutoff dates, and I can’t reconcile them from the public record. 129,000 and 26,153 and 40 are not three estimates of one quantity. Treat any “AI found X vulnerabilities” claim as meaningless without the report and date attached.

OpenAI’s Patch the Planet, launched 23 June with Trail of Bits, built the opposite workflow: every finding gets human review, a two-pass false-positive filter, and deduplication against existing issue trackers before a maintainer ever sees it. Its totals via Hughes are 1,646 found, 615 patches written, 13% merged. An order of magnitude fewer findings, and a better conversion rate.

Maintainers were already at capacity

The burden-shift risk isn’t hypothetical. curl shut down its paid HackerOne bounty on 31 January 2026 after its confirmed-vulnerability rate fell from roughly 15% to under 5%. (The project’s later moves, a no-reward return and a July pause, aren’t cleanly documented across sources, so read the January closure as the anchor rather than the whole arc.) HackerOne suspended new applications to the Internet Bug Bounty on 27 March, citing submission growth of 76% year over year, 46,947 submissions in March alone, around 25% confirmed exploitable.

Upstream, CISA published its CVE Quality Era Framework on 22 September, arguing the program has to stop optimising for growth. More than 67,000 CVEs were published in 2026 as of 18 September, with CVEForecast.org projecting about 96,000 for the year. That counts records, not unpatched installations. For a patch-adoption denominator there’s the KEV catalogue, around 1,734 entries in early October by third-party mirror, though I could find no reliable dated estimate of vulnerabilities with fixes available but not installed. That gap is worth naming: the number everyone reaches for rhetorically doesn’t exist in a citable form.

What the exploitation data refuses to support

VulnCheck’s State of Exploitation 1H-2026, published around late July, found 14 of 1,061 AI-attributed vulnerabilities (1.3%) confirmed exploited in the wild. That matches the baseline rate across the whole dataset. AI-found bugs are getting weaponised at ordinary rates, so far.

The same report has the number that should worry you: median time to exploitation fell from 120 days to 80, and 23.4% of exploited vulnerabilities were hit within a day of CVE publication. The pressure is on the clock.

The capability gap is measured in months

NIST’s CAISI assessed GLM-5.3 on 17 September across SEC-Bench Pro, ExploitBench, ExploitGym Userspace, and CAISI OSS-Fuzz, concluding the open-weight model trails the U.S. frontier by “about four months in an aggregate measure of performance.” Read the caveats: U.S. models were tested with cyber safeguards disabled “when applicable,” and CAISI disclaims any comparison to unreleased frontier models. That’s an open model with no safeguards against a frontier model stripped of its own, which tempers the finding without erasing it. Anthropic’s own evaluation reports GLM-5.3 building end-to-end exploits in 50 of 410 ExploitBench attempts against Mythos Preview’s 56; our earlier post covers the safeguard bypass rates. OpenAI’s “Defender’s Window” argues for a three-to-five-month defender advantage, though I could only reach it through secondary paraphrase, so treat the exact framing as unconfirmed.

Four months is enough time to patch a lot of things. It is well short of what fixing the 0.8% problem takes.

What to do with four months

The useful lever is the part of the pipeline with humans in it. OpenAI’s design, where every finding clears review and deduplication before reaching a maintainer, costs volume and buys conversion: 13% merged beats 0.8% fixed by any measure a maintainer cares about. Programs that push raw candidate volume at volunteers are transferring cost, and curl’s confirmed rate is the receipt.

Pair discovery access with funded triage and patch-writing on the receiving end, prioritise against KEV rather than raw severity labels (maintainers downgraded nearly half of Claude’s critical and high ratings), and measure programs on merged patches. Anthropic’s tiered CVP is a reasonable answer to who should hold the discovery capability. Who writes the fixes is still open.

Sources: Anthropic, Expanding the Cyber Verification Program • Anthropic, Project Glasswing initial update • OpenAI, Patch the Planet • NIST CAISI GLM-5.3 assessment • CISA CVE Quality Era Framework

Coverage: Chris Hughes, AI Just Broke Vulnerability Management • VulnCheck, State of Exploitation 1H-2026 • VulnCheck, CVEs attributed to Glasswing • BleepingComputer on curl’s bounty shutdown • HackerOne pauses the Internet Bug Bounty

Related on this blog: [AUTO] OpenAI pauses Astra over autonomous cyber capabilities • [AUTO] Daybreak’s real test: training adoption over subsidy • [AUTO] GPT-5.6-Cyber: OpenAI’s Exploit Development Model