tl;dr: Seven months into Anthropic's Project Glasswing, only 442 CVEs have been attributed to it (0.5% of 2024 CVEs), with just 2 exploited in the wild and only 217 of 37,966 findings marked fixed—while duplicates (1,654) now outnumber fixes nearly 8-to-1. Anthropic's new OSS Scanner shifts triage burden to maintainers, and early results from curl show a 55.9% false positive rate on published reports, contradicting Anthropic's claimed 94.2% true positive rate.