Anthropic finds more than 10,000 critical vulnerabilities in software worldwide

Anthropic has revealed the scale of a problem the information security world habitually underestimates. Its cybersecurity project Glasswing found more than 10,000 critical vulnerabilities in systemically important software in a single month. Of these, 1,094 real high-severity threats are confirmed.

The scale of the problem

Glasswing was launched as a limited Anthropic initiative. In its first month, the system flagged more than 10,000 vulnerability candidates in critical software used around the world. 1,726 true positives have been confirmed. Another 1,094 are classified as high- or critical-severity, meaning they need urgent fixes.

This is not just a statistic. It is an admission that the software underpinning the internet and critical infrastructure is full of serious holes that nobody has systematically closed.

What vulnerabilities were found

• Critical bugs in system libraries and network services
• Authentication and authorization problems
• Memory leaks, buffer overflows, race conditions
• Misconfigurations in popular open-source projects
• Input-handling vulnerabilities

Anthropic uses Claude for large-scale code analysis. The model can quickly scan large codebases and identify potential problems, work that would take a human audit years. AI does not replace the security expert, but it significantly speeds up discovery.

The problem of fix speed

The main catch: finding a vulnerability is only half the job. It still has to be fixed, tested, and the patch deployed. If AI finds vulnerabilities faster than developers can close them, security debt grows.

Anthropic clearly hopes that publicly disclosing these figures will push the global developer community to take code security more seriously. But there is a risk of the opposite effect: a figure of 10,000 vulnerabilities may frighten people instead of motivating them.

What it means

AI systems can now audit code at a scale and speed beyond human reach. That changes the security landscape. But the developer community must speed up its fixes for the identified problems, or we will live with a growing number of known but unpatched vulnerabilities in critical software.