Anthropic's red team finds open-source bugs faster than maintainers can ship fixes

Divided out, 516 fixes against 6,157 disclosures is an 8.4% patch rate ^[17]. Acknowledgement runs at 82.9% ^[18]. At least 4,587 reports that a maintainer has seen still have no known upstream patch ^[19]. The Netics Labs write-up on dev.to, which summarises the dashboard, argues that automated discovery has moved the constraint downstream, with patch rate bounded by the capacity of the projects receiving the reports ^[15]. Those projects are largely run by volunteers or small teams, the post notes, and each triaged report still has to be understood, reproduced, fixed, tested and released ^[16].

I think that reading holds, and Anthropic's own policy is the evidence. The programme commits to pace submissions to what maintainers can absorb ^[7]. The disclosure count is throttled before it is ever published. Only about 20.8% of raw findings reached human triage at all ^[20]. The dashboard also concedes that some findings confirmed as real remain unsent "due to capacity limitations" inside the programme itself ^[13].

The About page tells readers which of its own numbers to discount. I would like more dashboards to ship with that page. It says the true-positive rate includes real bugs already reported elsewhere and real bugs a maintainer decided not to fix ^[11]. The patch count is "a more reliable one", it says, though "patches take a long time to create" ^[12]. Even that count stops at release. The dashboard says a released patch "does not guarantee that those patches have been widely installed" ^[14].

For 8.4% to measure maintainer speed, most disclosures would need to be old enough to have run past the 90-day deadline and its 14-day extension ^[7]. The post does not break disclosures down by age. The patch figure is also a floor. Anthropic counts only fixes it knows about ^[2], and maintainers sometimes ship a fix without publishing an advisory ^[9]. A team watching feeds sees 584 identifier records, 219 CVEs and 365 GitHub Security Advisories ^[9]. Those records equal about 9.5% of the disclosure count ^[21]. They cover fewer findings than that, because one finding can carry both identifiers ^[9].

One figure in the post does not reconcile. It says external firms reviewed 5,674 candidates and confirmed 92.7% of the 6,123 as true positives ^[22]. Applied to 6,123, that rate gives about 5,676 confirmations, two more than the firms reviewed ^[24]. Another 4,824 findings went straight to maintainers without the independent check, at the maintainers' own request ^[6].

The disclosure plumbing is careful work. Findings still inside their window appear only as commitment hashes, so their existence and date can be proved while the content stays withheld ^[8].