Tracking Anthropic‑Discovered Vulnerabilities

By Naveen Malothu – AI Infrastructure Engineer, DevOps Architect, Founder @ Griffin AI Tech

1️⃣ What was released / announced

Anthropic just published an open‑source vulnerability feed called Glasswing (November 2024 update). The feed aggregates all CVEs, bug‑bounty disclosures, and internal security findings that affect Anthropic’s LLM stack – from model‑serving containers to the custom Rust‑based inference runtime. It’s delivered as a JSON‑lines endpoint (https://glasswing.anthropic.com/v1/feed) and also as a GitHub repository that ships a daily CSV snapshot.

2️⃣ Why it matters

If you’re building or operating LLM‑powered services, you’re already dealing with a massive attack surface:

• Model containers (Docker, OCI) that run on shared GPU nodes.
• Inference runtimes written in low‑level languages (Rust, C++) for latency.
• Prompt‑engineering pipelines that ingest user data and may inadvertently expose secrets.

Anthropic’s feed is the first community‑driven, model‑specific vulnerability stream. It gives you:

• Early warning – most entries are published within hours of discovery.
• Contextual relevance – each entry is tagged with the exact Anthropic component (e.g., claude-2.1-runtime, anthropic‑tokenizer).
• Automation‑ready format – JSON‑lines makes it trivial to plug into CI, SBOM generators, or security‑as‑code frameworks.

For DevOps and cloud teams, ignoring this feed is akin to running a production web server without subscribing to the official Ubuntu security notices. A single unpatched runtime bug can lead to remote code execution on your GPU fleet, compromising not just one model but every tenant sharing the node.

3️⃣ How to use it

Below is a minimal, production‑ready pipeline that pulls the feed nightly, turns it into a SARIF report, and fails the build if any high‑severity issue touches your stack.

Step 1 – Grab the feed

# Install the tiny helper (requires python>=3.9)
python - <<'PY'
import requests, json, sys
url = "https://glasswing.anthropic.com/v1/feed"
resp = requests.get(url, timeout=15)
resp.raise_for_status()
for line in resp.iter_lines():
    entry = json.loads(line)
    # Filter to only the components we ship
    if entry["component"] in {"anthropic-runtime", "anthropic-tokenizer"}:
        print(json.dumps(entry))
PY > glasswing_filtered.jsonl

Step 2 – Convert to SARIF (Static Analysis Results Interchange Format)

We’ll use the open‑source json2sarif utility.

pip install json2sarif
json2sarif glasswing_filtered.jsonl > glasswing.sarif

Step 3 – Integrate with GitHub Actions (or any CI)

name: Security Scan – Anthropic Glasswing
on:
  schedule:
    - cron: '0 2 * * *'   # run nightly at 2 AM UTC
  workflow_dispatch:
jobs:
  glasswing:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Pull Glasswing feed
        run: |
          python - <<'PY'
          import requests, json, sys
          url = "https://glasswing.anthropic.com/v1/feed"
          resp = requests.get(url, timeout=15)
          resp.raise_for_status()
          for line in resp.iter_lines():
              entry = json.loads(line)
              if entry["component"] in {"anthropic-runtime", "anthropic-tokenizer"}:
                  print(json.dumps(entry))
          PY > glasswing_filtered.jsonl
      - name: Convert to SARIF
        run: |
          pip install json2sarif
          json2sarif glasswing_filtered.jsonl > glasswing.sarif
      - name: Upload SARIF report
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: glasswing.sarif
      - name: Fail on high severity
        run: |
          jq -e '[.runs[].results[] | select(.level == "error")] | length > 0' glasswing.sarif && exit 1 || echo "No critical issues"

Step 4 – Optional – Enrich your SBOM

If you already generate an SBOM with syft or cyclonedx-bom, you can merge the Glasswing entries:

syft . -o cyclonedx > sbom.json
jq -s '.[0] * {"vulnerabilities": .[1].vulnerabilities}' sbom.json glasswing_filtered.jsonl > sbom_with_glasswing.json

That gives you a single artifact you can feed to downstream compliance tools (e.g., Snyk, Anchore).

4️⃣ My take

I’ve been wiring up LLM inference clusters on GKE for the past year, and the security surface has exploded. Early on we relied on generic CVE feeds, which missed a lot of the low‑level bugs that only show up in a custom Rust runtime. Glasswing changed that narrative for us.

• Automation wins – The moment we added the nightly job, a critical RCE bug in the token‑izer landed in the feed, and our CI blocked the rollout before any GPU node was patched. Without this, the bug would have sat in our backlog for weeks.
• Cost‑effective – By pulling only the components we actually ship, the pipeline stays under 200 KB per run, which translates to negligible compute cost on a serverless runner.
• Future‑proofing – Anthropic has committed to publishing all internal findings, not just public CVEs. That means the feed will eventually contain edge‑case issues like “prompt‑injection‑via‑metadata” that traditional scanners can’t see.

From an infrastructure perspective, the biggest lesson is treat LLM runtimes like any other critical binary. They deserve the same patch cadence, SBOM hygiene, and automated gatekeeping we apply to our base images. Glasswing gives us a source of truth for that process.

If you’re still on the “wait‑and‑see” mode, consider the risk: a single unpatched vulnerability can let an attacker escape the sandbox, spin up rogue containers on your GPU pool, and potentially exfiltrate model weights. In a regulated industry (finance, healthcare), that’s a compliance nightmare.

Bottom line: grab the feed, bake it into your CI/CD, and treat it as a first‑class security asset. It’s a small engineering effort that pays off in peace of mind and reduces the attack surface of your AI services.

Happy hacking (securely)!