Over six months of scanning some of the world’s most widely used open source projects, Anthropic’s models surfaced more than 29,000 candidate vulnerabilities. Its human review pipeline, which relies on six external security research firms to reproduce and triage findings, has worked through only about 6,000.
A disclosure dashboard puts some numbers behind the problem. As of October 2, outside security firms had confirmed 5,674 of the 6,123 findings they reviewed as valid, but only 516 vulnerabilities had been patched upstream.
🔗 Claude found 29,000 possible bugs in open source. Only 516 have been fixed.
Leave a Reply