Status: clean

Working tree clean. The portrait records everything.

On 22 May 2026, Anthropic published an update on Project Glasswing. In one month, Claude Mythos Preview, a model able to find and exploit on its own vulnerabilities no one had spotted in decades², together with around fifty partners, found more than ten thousand high- or critical-severity vulnerabilities in the world's most critical software¹. Further down, the same report gives another figure: of the 530 high- or critical-severity flaws disclosed to maintainers, 75 were fixed¹. The first number makes the headlines. The second measures the problem.

Anthropic states the reversal itself. The progress of software security used to be limited by how fast flaws were found; it is now limited by how fast they can be verified, disclosed and fixed¹. A fix takes two weeks on average, and some maintainers have asked Anthropic to slow its disclosures¹.

The imbalance was readable three months earlier. On 5 February, Anthropic announced that Claude Opus 4.6 had found more than 500 critical vulnerabilities in production open source code, some dormant for decades³. On 20 February, the company released a tool to fix them automatically⁴. The same day, Snyk calculated that those fixes carried statistically the same vulnerability rate as the code they repair⁵.

I checked the data behind these announcements. The imbalance they describe is a consensus, and the answer drawn from it, patch faster, dominates. It is not enough. AI-written code remains about as vulnerable as human code, at the same rate as two years ago, at an exploding volume, while the apparatus meant to see it, name it and fix it degrades at the same time.

A rate that does not move

The March 2026 Veracode update covers more than 150 models, including the latest flagships: GPT-5.2, Gemini 3, Claude 4.5 and 4.6. Secure-code rate: 55%, identical to the 2024 measurement⁶. Two years of spectacular functional progress, zero security progress. Chris Wysopal, co-founder of Veracode, coined a term for this stream: code slop⁸.

The measurements converge from one source to the next. Java: 72% security failure. Cross-Site Scripting: 86%. SQL injection, the most taught flaw in the history of software security, still fails one time in five⁷. And this code stays exploitable on the most recent models: an attack method published in 2026 extracts recurring vulnerabilities from software generated by GPT-5.2, Claude 4.5 Opus and Gemini 3 Pro, with up to 94% success⁹.

The contradiction with the 500 zero-days is only apparent. Finding a flaw in existing code is analysis: the model reads code it did not write, in a mature base, and reasons over data flows. LLMs excel at deep reading. Producing secure code is synthesis under simultaneous constraints of functionality, performance, maintainability and security. The model sacrifices security for functionality, because training optimizes completion. BaxBench, the ETH Zurich benchmark (392 tasks, 14 frameworks), measures this gap: Claude Opus 4.5, first on the leaderboard, produces code that is both correct and secure in 56% of cases¹¹. And Opus 4.6, the model that found the 500 zero-days, shows a vulnerability density up 55% over its predecessor when it writes code¹⁰. Excellence in detection, 45% failure in synthesis, on the same model, in the same window.

A volume that doubles

A rate steady at 45% in a volume that doubles every six months yields an absolute quantity of flaws that explodes while the ratios on the dashboards stay flat.

85% of developers use AI coding tools¹², 90% per DORA¹³. The objective measurement contradicts the perception. On telemetry from 10,000 developers, pull requests rise 98% while delivery metrics stay flat¹⁴. Under controlled conditions, AI-assisted developers are 19% slower, and perceive themselves 20% faster¹⁵. The gap between what people think they ship and what they ship reaches forty points.

Claude Code went from zero to 2.5 billion dollars in annualized revenue in nine months¹⁶. 4% of public GitHub commits, projected past 20% by the end of 2026¹⁷. Anthropic's chief executive estimates that within six to twelve months the models will do most, if not all, of the work of software engineers¹⁸.

The objective record follows. Across 1.6 million applications, security debt affects 82% of organizations, against 74% a year earlier¹⁹. AI code is behind one breach in five²⁰. Fewer than half of developers review AI code before committing it²¹. And the same insecure templates reappear identically in unrelated projects, because the same models produce the same flaws for developers who do not know one another²².

The curve already reads in the public databases. Georgia Tech's Vibe Security Radar has tracked, since May 2025, the CVEs directly attributable to AI coding tools, by tracing commit history²³. Second half of 2025: 18 cases in seven months. First quarter of 2026: 56. March 2026 alone: 35, more than all of 2025. Claude Code accounts for 27 of the 35, because it leaves a traceable signature the other tools erase. Researchers estimate the real figure five to ten times higher²³. The rate is flat. The volume attributable to AI follows an exponential.

Finding goes faster than fixing

The imbalance, everyone sees it now. In one month, Mythos found more than ten thousand critical flaws. Of the 530 disclosed, 75 fixed: 14% of what was reported to maintainers, less than 1% of what was found¹. Anthropic itself moves the bottleneck, from discovery to remediation¹. Palo Alto speaks of a vulnerability deluge and sets a three-to-five-month window to fix every flaw found before attackers gain the same capability²⁴. The watchword fits in two words: patch faster. Schneier already objects that this race is reactive, and calls for systemic resilience rather than staying one patch ahead²⁵. The disagreement I am putting forward is more precise: the rate that does not move turns the deluge into a permanent flow, not a backlog to clear, and the instrument meant to say what to fix goes blind at the same time.

One point must be conceded, on pain of aiming at the wrong target. The repair quality of recent models has improved. A February 2026 study on real code measures GPT-5 and Claude Opus 4.1 repairing 75 to 80% of detected flaws, against half a year earlier, and concludes that AI code is about as likely to contain a flaw as human code²⁶. An AIxCC team raises the correctness of its patches from 52% to 71% between 2025 and early 2026²⁷. Degradation by correction, the patch that breaks more than it repairs, was measured on previous-generation models: an autonomous LLM introducing nearly nine times more flaws than humans²⁸, critical vulnerabilities up 37.6% after five repair cycles²⁹. On recent models, that flank is closing.

The imbalance does not need it. The model excavates faster than any human, at any level of patch quality. Every flaw found and not fixed joins a reserve that grows, known but open, until the fix arrives (two weeks on average, when it arrives). What such a reserve offers an attacker belongs to another article in this series³⁰. Here, the point holds without it: the defensive chain finds flaws in its own code faster than it closes them.

The instrument blurs

What remains is what we can see of this reserve. The answer comes in a series of recent, converging measurements: less and less.

The deterministic validator, the static analysis on which the very idea of checking AI code rests, catches a third to a half of what it looks for. On 1,080 samples with ground truth set by hand, CodeQL correctly identifies a third of the targeted flaws, Semgrep half³¹. On the best-known classes, the ones these tools were built to recognize.

The benchmarks that rank the models are no better. An audit of the SWE-Bench Pro verifiers shows they accept a wrong implementation nearly one time in twelve and reject a correct one nearly one time in four³². As for SWE-bench Verified, long the field's reference, OpenAI stopped publishing its scores on it after finding that recent models reproduced its solutions word for word, already present in their training data³². The benchmark grades models that already know its answers.

The detector itself drifts. An LLM-based vulnerability detector, evaluated under realistic conditions (trained on the past, tested on the future), correctly identifies two flaws in three, and that performance varies twofold across periods, because vulnerabilities change shape over time³³. Piling on data does nothing: precision gains less than two points for sixteen times the compute³³.

Finally, the layer that names the flaws gives way. In April 2026, NIST stopped the systematic enrichment of CVEs not prioritized for the US federal government, unable to keep up with submissions³⁴. The global system that qualifies vulnerabilities produces more slowly than AI manufactures them. And the origin of the code stays invisible: 62% of security practitioners have no way of knowing where LLMs are used in their organization³⁵, no software supply chain framework (SBOM, SLSA, in-toto) captures who wrote the source code, and the rare traceability attempts are voluntary and bypassable³⁶.

Every instrument that would measure the real reserve saturates, drifts or falls silent. The ledger still exists, but no one keeps it up to date.

Fixing holds only for those who can afford it

The Glasswing update does contain fixes that succeeded, and fast. Mozilla fixed 271 flaws in Firefox, ten times more than with the previous model¹. Palo Alto shipped five times more fixes than usual¹. The Claude Security tool was used to patch 2,100 vulnerabilities in enterprise in three weeks¹.

What these successes share: an organization that owns its code and has the means to fix it, at machine speed, on its own perimeter. Anthropic says so itself, these fixes move fast because companies repair their own code, where open source depends on volunteer maintainers going through coordinated disclosure¹. On one side, the giants harden their code. On the other, the open source commons takes less than 1% of fixes, overwhelmed maintainers asking for a slowdown, and a deluge of low-quality AI-generated bug reports¹.

The programs that offer coding assistants to the maintainers of the most-used libraries (threshold: 5,000 GitHub stars or one million monthly npm downloads) target exactly the nodes of the dependency graph where transitivity is highest³⁷. They give maintainers the tool, not the time or the hands to use it. The capacity to keep up concentrates where the means are. Everywhere else, the volume arrives with nothing to absorb it.

What I do not know

Whether the fixes deployed at scale since April introduced new flaws. Glasswing had 75 of 530 vulnerabilities fixed, one company's tool patched 2,100 in enterprise in three weeks¹. The patch is AI code. No vendor has published a regression measurement on those fixes. Independent literature establishes a substantial reintroduction rate on previous-generation models²⁸. On today's, at scale, no one has checked.

The real cost of the detection results. Neither Anthropic for its 500 vulnerabilities, nor OpenAI for its Aardvark agent³⁸, has published the compute cost, the false-positive rate or the full methodology³⁹. The flattering figure is announced. What would judge its quality is not.

How the European regulatory framework will adapt. The CRA imposes due diligence on integrated components, the PLD creates strict, no-fault liability⁴⁰. I documented these mechanisms in article 12 of this series. Both texts assess a product at a given instant. Neither distinguishes human code from AI code, neither sees a reserve of flaws that grows under a blind measurement. The liability exists. The means to quantify it does not.

What I do know

The industry set a premise: that the figure on the dashboard describes the state of the system. It no longer does. The vulnerability rate of AI code has not moved in two years, recent models included. The volume doubles. And every instrument that would show the consequence, the validator, the benchmarks, the detector, the naming, the traceability, saturates or drifts at the same time. The real population of flaws grows faster than anyone can see, name or fix it.

One will object that recent models fix better. That is true, and it changes nothing. Patch quality has improved, AI code is worth about as much as human code, but the rate stays flat under an exponential volume, the find/fix imbalance widens, the measuring instrument is blind, and the capacity to keep up is being privatized in favor of those who repair their own code. Where the pace is held, it is because the means are there, not because the problem is solved.

Organizations that adopt AI code at this scale increase their exposure to the CRA and the PLD, which do not care about the origin of the code and hold the manufacturer responsible for the product placed on the market⁴¹. More flaws, more exposed surface, more potential 24-hour notifications⁴¹, and a global infrastructure that can no longer name them⁴². They do not know it, because nothing in their metrics shows it to them.

The status reads: working tree clean. The true record ages in a room no one opens anymore.

Seventeenth article in a series on the structural failures of Western cybersecurity:

• Article 1 : La vulnérabilité de la gestion des vulnérabilités
• Article 2 : La dépendance européenne aux standards américains
• Article 3 : Les États, architectes cachés du marché noir des vulnérabilités
• Article 4 : L'IA ou l'effondrement du modèle défensif occidental
• Article 5 : Desert Power — survivre sans l'Empire
• Article 6: I Am Altering the Deal
• Article 7: The Last Channel
• Article 8: Lord of Cyber War
• Article 9: The digital hawks
• Article 10: They Live... we sleep
• Article 11: Soylent Green
• Article 12: Ghost in the Binary
• Article 13: Now You See Me
• Article 14: The Prestige
• Article 15: Pitch Black
• Article 16: The Thing That Should Not Be

References

¹ Anthropic (2026). "Project Glasswing: An initial update." 22 May 2026 — 10,000+ high/critical flaws in one month; 6,202 estimated high/critical in open source out of 23,019; 530 disclosed, 75 fixed (65 advisories); two-week average delay; bottleneck relocated to human triage and remediation capacity; Mozilla 271 (×10 vs previous model), Palo Alto ×5, Claude Security/Opus 4.7 = 2,100 enterprise patches in 3 weeks https://www.anthropic.com/research/glasswing-initial-update

² Anthropic Frontier Red Team (2026). "Claude Mythos Preview." April 2026 — thousands of zero-days in major OSes and browsers, autonomous exploitation of a 17-year-old FreeBSD RCE https://red.anthropic.com/2026/mythos-preview/

³ Anthropic (2026). "Finding a new satisfiability-based approach to software vulnerability discovery with Claude." Frontier Red Team, 5 February 2026 https://red.anthropic.com/2026/zero-days/

⁴ Anthropic (2026). "Claude Code Security." 20 February 2026 https://www.anthropic.com/news/claude-code-security

⁵ Snyk (2026). "Why Anthropic Launching Claude Code Security Is Great News for the Industry." 20 February 2026 https://snyk.io/articles/anthropic-launches-claude-code-security/

⁶ Veracode (2026). "Spring 2026 GenAI Code Security Update." March 2026 — 150+ models including GPT-5.1/5.2, Gemini 3, Claude 4.5 and 4.6. Secure-code rate: 55%, identical to 2024 https://www.veracode.com/blog/spring-2026-genai-code-security/

⁷ Veracode (2025). 2025 GenAI Code Security Report. July 2025 — 80 tasks, 100+ LLMs, 4 languages. Java 72% failure, XSS 86%, SQL injection ~20% https://www.veracode.com/resources/genai-code-security-report-2025

⁸ Dark Reading (2025). Interview with Chris Wysopal, "code slop." October 2025 https://www.darkreading.com/application-security/ai-generated-code-leading-expanded-technical-security-debt

⁹ arXiv:2602.04894 (2026). "Extracting Recurring Vulnerabilities from Black-Box LLM-Generated Software." FSTab evaluated on GPT-5.2, Claude-4.5 Opus, Gemini-3 Pro — up to 94% attack success, 93% vulnerability coverage https://arxiv.org/abs/2602.04894

¹⁰ SonarSource (2026). Analysis of Claude Opus 4.6. 20 February 2026 — vulnerability density up 55% vs predecessor https://www.sonarsource.com/blog/why-claude-opus-4-6-requires-verification/

¹¹ Vero, M. et al. (2025). "BaxBench: Can LLMs Generate Correct and Secure Backends?" arXiv:2502.11844, ICML 2025 — Claude Opus 4.5: 56% correct and secure code https://arxiv.org/abs/2502.11844

¹² JetBrains (2025). State of Developer Ecosystem 2025 https://www.jetbrains.com/lp/devecosystem-2025/

¹³ Google Cloud (2025). 2025 DORA State of AI-assisted Software Development Report — 90% adoption, negative relationship between AI adoption and delivery stability https://cloud.google.com/devops/state-of-devops

¹⁴ Faros AI (2025). "The AI Productivity Paradox." July 2025 — pull requests +98%, flat organizational delivery https://www.faros.ai/blog/ai-software-engineering

¹⁵ METR (2025). "Measuring the Impact of AI Coding Assistants on Developer Productivity." July 2025 — 19% slower, +20% perceived https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/

¹⁶ Reuters / Sacra / The Information. Claude Code: $2.5B ARR, February 2026 https://sacra.com/c/anthropic/

¹⁷ GitClear / SaaStr. 4% of GitHub commits = Claude Code https://www.saastr.com/anthropic-just-hit-14-billion-in-arr-up-from-1-billion-just-14-months-ago/

¹⁸ VentureBeat (2026). Amodei quote, Davos, January 2026 https://venturebeat.com/security/anthropic-claude-code-security-reasoning-vulnerability-hunting

¹⁹ Veracode (2026). 2026 State of Software Security. 26 February 2026 — security debt 82% of organizations (74% the prior year), high-risk vulnerabilities 8.3% → 11.3% https://www.veracode.com/resources/analyst-reports/state-of-software-security-2026/

²⁰ Aikido Security (2026). State of AI in Security & Development 2026 — AI code behind one breach in five https://www.aikido.dev/state-of-ai-security-development-2026

²¹ Sonar (2026). State of Code Developer Survey. January 2026 — 48% always review AI code https://www.sonarsource.com/blog/state-of-code-developer-survey-report-the-current-reality-of-ai-coding/

²² arXiv:2512.18567 (2025). Top 1,000 GitHub repos 2022-2025, insecure templates propagated across unrelated projects https://arxiv.org/abs/2512.18567

²³ Infosecurity Magazine (2026). "Security Researchers Sound the Alarm on Vulnerabilities in AI-Generated Code." April 2026 — Vibe Security Radar, Georgia Tech SSLab. 18 (H2 2025), 56 (Q1 2026), 35 in March 2026 alone. Estimated 5-10× the detected figure https://www.infosecurity-magazine.com/news/ai-generated-code-vulnerabilities/

²⁴ Palo Alto Networks (2026). Klarich, L. "Defender's Guide to the Frontier AI Impact on Cybersecurity." April 2026, May 2026 update — "Vulnerability Deluge" and "flood of patches," strategic three-to-five-month window, goal of fixing every vulnerability found before the capability spreads to adversaries; May update: 26 CVEs (75 issues) published vs fewer than 5 per month usually https://www.paloaltonetworks.com/blog/2026/04/defenders-guide-frontier-ai-impact-cybersecurity/

²⁵ Schneier, B. (2026). "On Anthropic's Mythos Preview and Project Glasswing." Schneier on Security, 13 April 2026 — Glasswing described as a reactive approach, "racing to patch holes before attackers adapt"; call for "systemic resilience rather than hoping to stay one patch ahead" https://www.schneier.com/blog/archives/2026/04/on-anthropics-mythos-preview-and-project-glasswing.html

²⁶ Belozerov, V., Barclay, P.J., Sami, A. (2026). "Secure Coding with AI — From Detection to Repair." arXiv:2504.20814, v2 February 2026 — GPT-5 and Claude Opus 4.1 repair 75-80% of detected flaws (vs ~50% in 2024); AI code about as vulnerable as human code https://arxiv.org/abs/2504.20814

²⁷ Team Atlanta (2026). "Patching Vulnerabilities with Coding Agents in 2026." — patch correctness 52% (Claude 3.7 Sonnet, 2025) → 71% (early 2026), 630 patches hand-reviewed https://team-atlanta.github.io/blog/post-patch-2026-ensemble/

²⁸ Sajadi, A., Damevski, K., Chatterjee, P. (2025). "How Safe Are AI-Generated Patches?" arXiv:2507.02976, v3 December 2025 — 20,000+ GitHub issues; the autonomous LLM (Llama 3.3 70B, previous generation) introduces nearly 9× more flaws than developers, in patterns distinct from human code https://arxiv.org/abs/2507.02976

²⁹ arXiv:2506.11022 (2025). IEEE-ISTAS 2025, peer-reviewed — +37.6% critical vulnerabilities after 5 repair iterations (previous-generation models), "feedback loop security degradation" https://arxiv.org/abs/2506.11022

³⁰ See article 4 of this series: "AI, or the Collapse of the Western Defensive Model" — AI as an offensive multiplier and the exploitation of the reserve of known, unpatched flaws

³¹ Firouzi, E., Ghafari, M. (2026). "Persistent Human Feedback, LLMs, and Static Analyzers for Secure Code Generation and Vulnerability Detection." arXiv:2602.05868, February 2026 — 1,080 samples, human ground truth. Recall CodeQL 0.34, Semgrep 0.54 on the CWE Top 25 https://arxiv.org/abs/2602.05868

³² VentureBeat (2026). "DeepSWE blows up the AI coding leaderboard..." May 2026 — Datacurve audit: SWE-Bench Pro verifiers accept a wrong implementation 8.5% of the time, reject a correct one 24%; OpenAI stopped reporting SWE-bench Verified after finding training-data contamination https://venturebeat.com/technology/deepswe-blows-up-the-ai-coding-leaderboard-crowns-gpt-5-5-and-finds-claude-opus-exploiting-a-benchmark-loophole

³³ Dou, X., Bahsi, H., Guerra-Manzanares, A. (2026). "Enhancing Continual Learning for Software Vulnerability Prediction." arXiv:2602.23834 — LLM detector, Macro-F1 0.667 (two flaws in three), performance varying twofold over time; +2 points for ×15.9 compute https://arxiv.org/abs/2602.23834

³⁴ NIST (2026). "NIST Updates NVD Operations to Address Record CVE Growth." 15 April 2026 — systematic enrichment halted, prioritization limited to CISA KEV CVEs and US federal/critical software. +263% CVE submissions between 2020 and 2025 https://www.nist.gov/news-events/news/2026/04/nist-updates-nvd-operations-address-record-cve-growth

³⁵ Harness (2025). Survey of 500 security practitioners (US, UK, France, Germany) — 62% have no way of knowing where LLMs are used in their organization. Via VentureBeat, January 2026 https://venturebeat.com/security/seven-steps-to-ai-supply-chain-visibility

³⁶ Mandel-Macaque (2026). git-memento — tracing of AI sessions per commit via git notes. Declarative, voluntary and bypassable control https://github.com/mandel-macaque/memento

³⁷ Vaughan-Nichols, S.J. (2026). "Anthropic and OpenAI Are Battling for the Best Open-Source Maintainers." The New Stack, 6 March 2026 — programs targeting maintainers at 5K+ GitHub stars / 1M+ npm downloads https://thenewstack.io/openai-anthropic-open-source/

³⁸ OpenAI (2025). "Aardvark: An Agentic Security Researcher." 30 October 2025 https://openai.com/index/introducing-aardvark/

³⁹ The Register (2026). "Infosec community panics over Anthropic Claude Code Security." 23 February 2026 — neither false positives nor compute cost published https://www.theregister.com/2026/02/23/claude_code_security_panic/

⁴⁰ See article 12 of this series: "Ghost in the Binary" — CRA, PLD, due diligence and strict liability https://www.klaerenn.com/ghost-in-the-binary/

⁴¹ See article 12 of this series: "Ghost in the Binary" — 24-hour reporting obligations https://www.klaerenn.com/ghost-in-the-binary/

⁴² See article 15 of this series: "Pitch Black" — the topology of European dependence on the NIST/NVD infrastructure https://www.klaerenn.com/pitch-black/