Glasswing Floods Maintainers, Fixes Few Findings

Glasswing demonstrates that AI can scale vulnerability discovery faster than open-source communities can validate, prioritize, and remediate it. The bottleneck has shifted from finding bugs to producing trustworthy, actionable reports.

• –Only 0.45% of tracked Glasswing-linked CVEs appear in VulnCheck’s exploited-in-the-wild catalog.
• –The gap between Anthropic’s reported true-positive rates and maintainer-level reviews suggests severity inflation and noisy triage.
• –Duplicate and withdrawn findings outnumber confirmed fixes, adding operational cost for already understaffed projects.
• –OSS Scanner’s model-generated fast track may help well-resourced maintainers, but risks overwhelming smaller teams with unverified reports.
• –The program’s real legacy may be proving that vulnerability remediation—not vulnerability discovery—is the harder scaling problem.