The September 21, 2026 snapshot of Patrick Garrity’s Anthropic CVE tracker listed 225 vulnerabilities linked to Anthropic, Claude, Anthropic Research, or associated collaborations. Only one entry was marked as exploited in the wild: CVE-2026-26980, a vulnerability affecting Ghost CMS. That puts the tracked exploitation share below 0.5% in that dated snapshot.
The result draws a useful line between finding vulnerabilities and seeing attackers use them. A large CVE ledger can show substantial discovery and disclosure activity; it does not, by itself, show that the vulnerabilities are producing an unusually large real-world attack wave.
225 vulnerabilities attributed, one marked exploited
The tracker’s 225 records cover mixed attribution. They include work credited to Anthropic researchers, Claude, Anthropic Research, and collaborations with other security researchers and organizations. The count therefore is not a count of 225 vulnerabilities independently established as autonomous discoveries by Claude Mythos Preview.
The single exploited entry is CVE-2026-26980, which affects the Ghost CMS Content API. It is an unauthenticated SQL-injection vulnerability that can permit arbitrary database reads. The tracker assigns it a CVSS score of 9.4, and Ghost 6.19.1 is identified as the fixed version.
The snapshot does not establish the affected installations, threat actors, exploitation dates, or the scope of the campaign behind that entry. The useful conclusion is narrower: CVE-2026-26980 was the only record carrying an exploited-in-the-wild marker in the September 21 tracker view.
| Measure | Glasswing-linked tracker snapshot | Historical or technical context |
| Anthropic- or Glasswing-attributed CVEs | 225 | The records have mixed attribution |
| Entries marked exploited in the wild | 1 | CVE-2026-26980 in Ghost CMS |
| Share of tracked entries marked exploited | Less than 0.5% | A historical range cited by Patrick Garrity was just under 1% to 2% |
What Project Glasswing measures
Anthropic announced Project Glasswing on April 7, 2026 as a restricted defensive-security initiative. Vetted participants received access to Claude Mythos Preview, an unreleased general-purpose frontier model, to find and help remediate vulnerabilities in critical software and open-source dependencies. Anthropic said the model had found thousands of previously unknown vulnerabilities and reported an 83.1% CyberGym vulnerability-reproduction score for Mythos Preview, compared with 66.6% for Claude Opus 4.6.
Claude Mythos Preview was not planned for general availability. Its access model matters because the program’s stated purpose was defensive work by vetted participants, not a public consumer release.
The benchmark and the CVE tracker answer different questions. CyberGym measures performance on a vulnerability-reproduction task reported by Anthropic. The tracker records vulnerabilities associated with Anthropic and related collaborations, along with the exploitation status attached to individual entries. Neither number can stand in for the other.
Finding a flaw is not the same as seeing it used
The gap between discovery and exploitation is the central lesson of the September snapshot. Security teams still have to validate a finding, assess its severity, coordinate disclosure, prepare a fix, and deploy that fix. Those steps determine whether a vulnerability becomes a practical risk for users.
Patrick Garrity said the tracked vulnerabilities had not produced a clearly different threat outcome from a random selection of vulnerabilities. The result is a warning against treating the number of CVE records as a direct measure of attacker impact.
That distinction also explains why the 225 figure should remain tied to September 21, 2026. It is a dated tracker count, not a timeless total and not a measurement of every vulnerability Anthropic’s models may have found.
The harder work starts after discovery
AI-assisted discovery can accelerate the first stage of a security process, but remediation still requires careful engineering. A 1Password study covering 6,080 patches generated by ChatGPT-5.5 and Anthropic Opus 4.8 found complete remediation in 26% of cases.
Veracode’s cited 2026 study reported a 56% security pass rate for AI-generated code across more than 100 models and 80 coding tasks. The populations and methods differ from the 1Password study, so the figures are not interchangeable. Together, they put a practical boundary around the promise of automated security work: generating a patch is not the same as proving that the vulnerability has been fixed safely.
Triage, code review, regression testing, maintainer coordination, and patch deployment remain part of the job. In other words, AI can raise the volume of findings faster than organizations can necessarily process them. The operational bottleneck moves downstream.
What the Ghost case tells us
CVE-2026-26980 gives the Glasswing story a concrete example. The affected component is Ghost’s Content API, and the flaw is an unauthenticated SQL injection capable of arbitrary database reads. Ghost 6.19.1 is identified as the fixed version, while the tracker’s CVSS value is 9.4.
That is a serious technical profile, but the September 21 snapshot still records one exploited entry among 225 linked records. The distinction matters for anyone assessing AI-assisted vulnerability discovery: the size of the discovery ledger and the number of vulnerabilities attackers are using are separate measurements.
