Project Glasswing, Anthropic’s partnership scheme pairing Claude with external security teams, verified at least 129,000 software vulnerabilities between April and July 2026. Anthropic’s own scanning of open-source code added a further 5,500 by October. More than 33,000 of the combined total are rated critical or high severity, and Anthropic itself says that figure is likely an undercount, since it rests on survey data from only a subset of Glasswing’s partners.
Anthropic published those numbers in early October, in the same announcement that folded Glasswing into an expanded three-tier Cyber Verification Programme. Defence Access covers incident response, malware reverse engineering and vulnerability validation, open to security teams defending systems they own. Red Team Access adds authorised penetration testing against systems an organisation has permission to probe. Specialised Access, the least restricted tier, is reserved for organisations vetted jointly with the US government to test safety-critical systems such as power grids, telecom networks and interbank transfer infrastructure. Existing Glasswing members move straight into that top tier without reapplying.
Anthropic illustrates what each tier actually unlocks with its own benchmark, CyScenarioBench, run as fifty trials per tier. With no programme access, every attempt was blocked at the first prompt. Defence Access blocked forty-six of those fifty. Red Team Access blocked none, and the model completed thirty-four of fifty, a result Anthropic says matches its unrestricted 67.6 per cent success rate on the same test. The tiers are not a marketing layer sitting on top of an unchanged model. Each one genuinely unlocks more capability, which is exactly why the question of what happens to the output matters as much as the access decision itself.
The Gap
The detection number is the one making headlines. A quieter detail was further down the same disclosure. Of the thirty-three partner reports behind the 129,000 figure, fewer than half stated how many of the flaws found had actually been patched, and Anthropic said that was often because remediation was still under way.
That detail deserves more attention than the number everyone is quoting. An AI system found more verified vulnerabilities in four months than most security teams uncover in years, and for most of those findings, the organisations receiving them could not yet say whether a fix existed. Detection accelerated by an order of magnitude. Remediation capacity did not move with it.
Why This Sits with Governance, Not Just Security
A vulnerability scanner that outpaces every human team that came before it is not automatically a win. It is a capacity-planning problem dressed as a security headline. Someone has to triage 129,000 findings against a fixed number of engineering hours, decide which of the 33,000 critical and high-severity items get worked first, and own the call on which of the rest wait their turn. None of that scales the way the discovery did.
Closing that gap is precisely the kind of work a PMO exists to do. The decision on which vulnerabilities get fixed first belongs with security leadership. A PMO’s role sits one step earlier: making sure a named person holds the triage queue before the next scan produces another five-figure backlog with nobody attached to it. An unowned vulnerability list behaves like an unowned AI pilot. It sits on nobody’s priority list, grows quietly, and turns into a crisis only once something inside it gets exploited.
Before the Next Scan Runs
Anthropic is widening this programme. More organisations will get Claude-assisted scanning before the remediation side of this equation has caught up. AI-assisted vulnerability hunting already works at scale, Glasswing settled that question. The sharper lesson sitting underneath it is that finding problems faster than anyone can resource the fix creates a risk of its own, one that belongs to governance as much as to engineering.
Pick the last vulnerability scan your organisation ran. Name the person who owns the decision on which findings get fixed first, and ask them how long the current backlog has been waiting.