AI vulnerability findings make remediation the next bottleneck
Anthropic’s November 2 ledger records 5,087 disclosed findings and 629 known patches, while a separate n8n advisory gives workflow operators a concrete isolation vulnerability to fix.
Anthropic’s disclosure ledger records 5,087 findings across 680 open-source projects as of November 2, with 629 known to have been patched.
The remaining 4,458 have no known patch status in that accounting; they should not be described as confirmed unpatched vulnerabilities. These are cumulative disclosures from a program running since November 2025, not discoveries made during this catch-up period. [1][2]
The pipeline also matters. Of the disclosed findings, 1,862 went through the program’s external-review route and 3,225 were reported directly. The ledger’s validation rate for a reviewed subset cannot be applied to every disclosure. Its methodology also warns that deduplication and withdrawals can reduce totals between snapshots. An upstream patch record says nothing by itself about how many downstream installations have upgraded. [1][2]
Separately, n8n’s October 28 advisory describes an expression-isolation escape available to authenticated users who can create or edit workflows. Maintainers identify fixes in versions 1.123.89, 2.45.5, 2.46.1 and 3.0.1, and later versions in those release lines. Operators should compare their installed version with the advisory and apply the appropriate update. This n8n finding is not attributed here to Anthropic’s program. [3][4]
Sources & details 4 sources
Discuss in your voice app
Take the reporting, visual explanations and original sources into a conversation. Copy the brief, paste it into your preferred assistant, then start its voice mode.
Paste the brief into your voice app to discuss this reporting.Reporting sources
- Anthropic vulnerability disclosure ledger
Snapshot at November 2, 19:30 UTC; cumulative disclosure and known-patch totals, with separately reviewed and direct-report routes.
- Ledger methodology
Definitions, patch-status limits, duplicate removal and withdrawals. Same operator’s accounting, not an independent audit.
- n8n maintainer security advisory
October 28 advisory; authenticated workflow-editor scope and four fixed version branches. No exploit instructions reproduced.
- n8n 2.46.1 release record
October 28 release existence; patch applicability comes from the maintainer advisory, not this change list alone.
Images & figures
629 of 5,087 disclosures were known patched in the November 2 ledger; the remaining 4,458 have unconfirmed patch status.
Euangelion · Source · Usage terms · Download figure