Anthropic’s vulnerability-disclosure program is expanding chiefly through direct reports to software maintainers. Comparing its August 26 snapshot with the update published October 2, that route accounts for about 92% of the net increase in displayed reports. The company says direct disclosure does not receive the same independent check as findings sent through its external security firms.
That changes how to read a growing bug count. A maintainer receiving a report needs to know what has already been reproduced and assessed, while someone evaluating AI security tools needs to distinguish finding a candidate from delivering an actionable fix. Both routes can produce useful work; they arrive with different evidence behind them. Public fixes in opencontainers/runc and twigphp/Twig show why the receiving project’s assessment matters.
Where the growth appears
| Reports sent to maintainers | Aug 26 | Oct 2 |
|---|---|---|
| Direct disclosure | 1,278 | 4,824 |
| External review route | 1,022 | 1,333 |
| Total | 2,300 | 6,157 |
Subtracting the two snapshots gives 3,546 additional reports in the displayed direct total, out of 3,857 overall. This is a comparison of changing totals, not a tracked group of newly submitted bugs. Entries can be corrected, withdrawn or consolidated under the dashboard’s published rules.
The historical context supports a practical explanation. In its May 22 Glasswing update, Anthropic described human verification, disclosure and patching as bottlenecks. It said some maintainers wanted fewer reports at a time, while others requested findings before independent triage. Direct delivery can therefore bring wanted information forward. These totals do not establish how much of the subsequent growth was requested, useful or burdensome.
The wording has broadened too. August’s chart described direct reports as requested by maintainers. October’s chart drops that qualification, and its explanation says direct disclosure also happens on request. That documents a change in the public description, without establishing when any operational policy changed.
The patch is where the report becomes specific
Older, externally reviewed cases show why the receiving project’s judgment matters. They are examples of adjudication, not samples of the recent direct-report growth.
In Twig, the PHP template engine, a template name could become executable code inside a generated error message. The upstream patch changes how ModuleNode constructs that message, using a formatting expression. Its regression checks that a hostile name remains literal text and produces no executed output. The May advisory credits Anvil Secure with Claude and Anthropic Research, and identifies version 3.26.0 as patched. This is a concrete report-to-fix result.
The container runtime runc supplies a different lesson. Its June advisory credits an earlier reporter before Ada Logics and describes narrower consequences than a broad host-filesystem warning suggests. Its fix replaces vulnerable path-based device setup with operations scoped through file descriptors. The maintainer explicitly explains why the host’s usual terminal-device targets are unaffected. Confirming a real bug does not establish first discovery or settle its practical impact.
These records also resist a simple story of inflated severity. Twig’s finding card records high ratings from Claude and the reviewing firm, while the maintainer rates it critical. Independent assessment can increase the urgency as well as narrow the claim.
Follow the review path
The dashboard’s firm-reviewed validity percentage includes duplicate and “won’t fix” findings, according to its glossary. It cannot be applied to the direct route. Nor does this mixed-model program establish the performance of one closed model, or a remediation rate from reports of different ages.
We inspected the public snapshots, advisory records and patch definitions; we did not reproduce the vulnerabilities or audit Anthropic’s internal discovery process. The useful next comparison is a dated group of reports followed through each review route to maintainer decisions and shipped fixes. That would show which part of the expanding pipeline is delivering more usable security work—and where the next investment in human review would help.