I see that I made several errors in my most recent post on this subject. References; https://www.anthropic.com/research/glasswing-initial-update https://red.anthropic.com/2026/cvd/
I wrote: > Security firms and Anthropic staff examined 1752 of the 6202 packages > (which implies that 4450 were not examined by them.) Of the 1752 > examined 1092 were confirmed to be positive. 1092 / 1752 = 0.623 or > 62.3% By applying this ratio to 6202 packages we arrive at an > estimate of 3866 problems of high or critical severity. "6202 packages" should be "6202 problems". I wrote: > For 530 of the 1092 vetted vulnerabilities, notices were sent to > maintainers (which implies that for 562 confirmed vulnerabilities > disclosure is pending.) Of the 530 problems 75 have been patched > by developers. I made a mistake here. 530 is an estimate of high or critical vulnerabilities. "Estimate" is an odd thing to say, because Anthropic itself is sending reports to maintainers. The explanation is that some maintainers requested full disclosure of all potential issues discovered. 1129 issues were disclosed in this manner and this set is disjoint from the 1092 vetted. Mythos gave 175 as an estimate of the number of high or critical vulnerabilities in the 1129. That means that 355 (= 530 - 175) of the disclosures originated from the 1092 vetted. By my calculation there should be 737 (= 1092 - 355) problems awaiting disclosure, not 562. I wrote: > The numbers 1900, 1726 and 467 which appear in the summary chart do > not appear in the text. This is because the text discusses high or critical vulnerabilities while the chart counts all vulnerabilities regardless of severity. I don't see falsified figures, but find this confusing. To provide additional sets of figures for those who would find finer detail helpful one should attach a spreadsheet. Akira Urushibata _______________________________________________ libreplanet-discuss mailing list [email protected] https://lists.libreplanet.org/mailman/listinfo/libreplanet-discuss
