First screen, captured 3 days ago. Open the video.

Tracking Anthropic-discovered vulnerabilities

What HN thinks

Forty thousand findings, two hundred fixes, and everyone is certain the other side is reading the numbers wrong.

Reports are real and high quality
Some maintainers, notably Fil-C's author, found Anthropic's reports accurate with excellent test cases, and others note private codebases are quietly patching serious issues that never become public CVEs.
High false positives, maintainer burden
Others cite Linux and curl maintainers and their own triage: many findings are junk, duplicates or low severity, patches are often poor, and volunteers get swamped.
Article is a VulnCheck ad
Several argue the blog uses a tangential public dataset and conveniently concludes in favour of its own prioritisation product, while low exploitation is arguably the point of early disclosure.

Consensus: No consensus on overall quality, but most agree AI finds bugs faster than humans can verify and fix them, and that public CVE counts capture only part of the picture.

Recommended in the comments

GLM-5.3-Flash (product): One commenter ran it locally against their repos and found verified RCE and account takeover bugs without token bills or sending data to a vendor.
oss-scanner ↗ (tool): Mentioned as Anthropic's effort that includes patches and asks for a project's threat model, though results were mixed.
Claude for OSS (service): Suggested so maintainers can have Claude draft fixes without paying.

Summarised by Claude from the comment thread 2 days ago.

Points: 430
Comments: 202
Best rank: #1
Posted: 2026-11-10 by panic
Category: Security

anthropic project-glasswing cve vulnerability-disclosure ai-vulnerability-research open-source-maintainers curl vulncheck

All captures:

Full page

Captured 3 days ago. Click for the whole screenshot.

Looks similar

Screenshot of stork.ai: Apple capped engineers at a $200 daily AI budget

Apple capped engineers at a $200 daily AI budget (stork.ai)

60 points by GloVin 4 days ago | 76 comments

A Stork AI daily newsletter issue led by a report that Apple cut some engineers' daily AI spending cap to $200, plus other AI news items.

apple ai-costs llm-inference tokenization

Wasmer 5.0 (wasmer.io)

171 points by syrusakbary 2 years ago | 44 comments

Screenshot of aikido.dev: Telnyx package compromised on PyPI

Telnyx package compromised on PyPI (aikido.dev)

70 points by overflowy 7 months ago | 25 comments

Screenshot of planned-obsolescence.org: AI is dramatically accelerating AI research

AI is dramatically accelerating AI research (planned-obsolescence.org)

333 points by yurivish 7 days ago | 300 comments

Ajeya Cotra's Substack post arguing a METR report shows AI is already roughly doubling AI capabilities progress at Anthropic, implying rapid compounding toward superintelligence.

ai-safety recursive-self-improvement anthropic metr

Screenshot of pnpm.io: Pnpm has a new setting to stave off supply chain attacks

Pnpm has a new setting to stave off supply chain attacks (pnpm.io)

191 points by ivanb 1 year ago | 121 comments

Screenshot of terrytao.wordpress.com: Lean Grimoire

Lean Grimoire (terrytao.wordpress.com)

51 points by smilelamp 1 day ago | 8 comments

Terence Tao blog post announcing Lean Grimoire, a coding-agent-rebuilt version of his QED logic crafting game with Lean proof display and a fantasy mode.

lean theorem-proving logic terence-tao