The unit is the fix

37,966 findings. 7,349 made public. 217 fixed. That is Anthropic's Glasswing disclosure ledger as of November 2, by the count in Patrick Garrity's seven-month update for VulnCheck, which drew 419 points on Hacker News this week. Between his September tally and this one, the ledger added 11,813 findings. It added 15 fixes.

The easy read is that the model is bad at finding bugs. The numbers support something narrower. Finding a bug got cheap. Checking one didn't. An unconfirmed finding isn't security yet; it's a work order, and a program that keeps score in findings is counting the work it has handed to somebody else.

Anthropic has said where that work piles up. Its OSS Scanner launch post on October 8 put it plainly:

The scanner's answer is to hand the bottleneck to the projects. Its reports are "fully model-generated, without human review or triage," and the maintainers who opt in do the validating. Garrity's summary is hard to improve on: "the triage bottleneck didn't go away. It moved to the maintainers."

curl shows what moving it costs. Daniel Stenberg's project got 45 reports from the scanner, one rated medium and the rest low, and he is publishing them a few at a time "to soften the impact for the team." Of the 34 out so far, 19 were judged not to be vulnerabilities, 6 were confirmed as low severity, and 9 are still waiting. That is roughly three dead ends read for every real bug, and every real bug so far is minor.

Finding a bug got cheap. Checking one didn't.

The ledger's most revealing column is duplicates. It went from two in September to more than 1,600 by November, and duplicates now outnumber fixes about seven to one. Garrity's explanation is that "the longer findings sit, the more likely someone else finds and fixes them first." A duplicate proves the bug was real; someone else hit it too. It also proves the finding sat in a queue until it became somebody else's fix.

The fair objection is that a queue full of real bugs still beats no queue. AI is good at finding vulnerabilities, and Garrity says so himself. Six confirmed curl bugs are six real bugs that might otherwise have sat for years, and curl asked for the scan. All true. But Glasswing didn't launch on a handful of low-severity bugs. It launched on "thousands of additional high- and critical-severity vulnerabilities," and in September Garrity found Claude rating 91.5% of its ledger findings critical or high, against 51.3% from the maintainers who checked them. A severity label is a claim on someone's attention. Run it hot and every false report jumps the line.

The number that would settle this is fixes per hour of maintainer time, and nobody publishes it. Until someone does, a ledger with 37,966 entries and 217 fixes isn't a security record. It's an inbox, and someone else is reading it.