Tracking vulnerabilities that credit the Anthropic research team (github.com)

Anthropic's Project Glasswing has recently come under scrutiny as its vulnerability disclosure efforts yield mixed results. The project has so far led to the tracking of 300 Common Vulnerabilities and Exposures (CVEs), with 128 findings that were addressed by the Anthropic team, and 243 findings that were withdrawn. This raises questions within the AI and cybersecurity communities regarding the effectiveness and reliability of the Glasswing initiative in identifying and managing security vulnerabilities, particularly as some of the findings stem from collaborations with external researchers. Significantly, the project has showcased how AI models like Claude are being utilized to discover high-impact vulnerabilities across various software products. For instance, several CVEs reported were found in popular platforms like Apache Thrift and Legion of the Bouncy Castle, with severity scores ranging from 8.2 to a critical 9.2. The ability of AI to assist in vulnerability assessment highlights its potential to enhance cybersecurity practices, though the high number of withdrawn findings also underscores the challenges in this domain. This project illustrates the evolving role of AI in improving software security while also emphasizing the need for robust verification mechanisms in AI-assisted vulnerability detection.