Audit Finds Anthropic's AI Bug-Finding Project Produced Far More Reports Than Fixes

·8 views

An analysis of Anthropic's Project Glasswing, which aimed to responsibly disclose AI-discovered vulnerabilities, finds that its ledger lists 37,966 total findings but only 217 fixes. VulnCheck's seven-month assessment and a recomputation from a public tracker of credited CVEs (450 on file) show findings growing rapidly while fixes lag far behind. Maintainers such as curl's Daniel Stenberg rejected more than half of the reports they received, and only a small share of the findings have been made public. The analysis acknowledges that the project has produced some real, serious vulnerabilities, including two added to CISA's exploited-in-the-wild catalog. The central concern is that unreviewed machine-generated reports shift a heavy triage burden onto unpaid open-source maintainers.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

osFoundry adds a prompt library with versioning and reusable skills for agents

osFoundry, a desktop app combining chat, agents, files and tools, now includes a Prompt Library that gathers prompts in one searchable place with favorites and usage counts. Users can save edits either by overwriting a prompt or as a new version, keeping earlier wording available for reuse. Prompts can contain placeholders such as {{product}} that the app fills in through a simple form before inserting the text into the chat. Proven prompts can also be converted into skills in Studio, which agents use automatically when a task matches their trigger and assigned tools.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Testing a pump underload detector before it controls a motor

A running pump may draw less current when it loses load, but a low current reading alone cannot confirm a dry pump, so the detector should report suspected underload with supporting context. Measurements should begin only after the motor is confirmed running and the startup window has passed, and mismatches between run commands and contactor feedback should be logged. Missing, stale, or invalid current data should be treated as a sensor fault rather than as zero current. The alert should use its own persistence timer and reset when readings return to normal, while latched alarms, motor-stop logic, and protection hardware remain independent of the telemetry. Validation should involve replaying simulated traces, comparing results against normal operation at several operating points, and logging timestamps, RMS current, motor state, thresholds, and fault reasons.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Solana token rules can be verified with a single RPC call, no SDK needed

A developer published a method for reading a Solana token's rules using one standard RPC request, requiring no SDK, wallet, or keys. The approach decodes the token's mint account to reveal its owner program, mint and freeze authorities, and Token-2022 extensions such as transfer fees, transfer hooks, and permanent delegates. The author applies the check weekly to one token and says it recently corrected earlier documentation that had misstated the token's technical setup. Using the method on the WEN mint, the author found it runs on the original SPL Token program with authorities revoked and no extensions. The post argues that repeatable, rerunnable checks provide stronger evidence than one-time snapshots.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

RNNoise and DeepFilterNet: Key Facts and What to Test on a Device Board

The source notes that neither RNNoise nor DeepFilterNet publishes a microcontroller-class cost, so developers must measure it on their own hardware. The RNNoise paper targets real-time 48 kHz operation on a low-power processor, while DeepFilterNet2 reports a 0.04 real-time factor on a notebook Core-i5 CPU. One preprint found that original noisy audio produced lower semantic word error than enhanced audio across all 40 tested configurations, though this is a single study. The article stresses that a neural denoiser must fit the chip and be checked for its effect on downstream speech recognition. It also flags that both tools assume 48 kHz audio and that no latency figure is published, so these must be measured on the full processing path.

0 comments Read more at DEV Community