ANTHROPIC-LINKED CVES PILE UP, ATTACKERS MOSTLY SHRUG

Summary from the TLDR InfoSec newsletter

VulnCheck's Patrick Garrity tracked 225 CVEs tied to Anthropic's Project Glasswing, which gives partners access to the Claude Mythos Preview model for bug-hunting. Only one, a critical SQL injection in Ghost (CVE-2026-26980), has been exploited in the wild. Garrity says that historically 1-2% of vulnerabilities are weaponized, so this rate isn't unusual. AI models are uncovering more bugs, driving recent record patch counts from Microsoft, Apple, and Palo Alto Networks, but fixing bugs remains weak: 1Password found that Opus 4.8 and ChatGPT-5.5 fully resolved vulnerabilities in only 26% of 6,080 patches tested, and Veracode measured a 56% average security pass rate across 100+ models.