When I first saw “automatically stop dependency attacks,” I thought of my own small projects
Last Tuesday night, I was still working on a client website in my Hangzhou rental apartment when a risk alert suddenly appeared in the admin panel. My first reaction was to upgrade, but there were too many components, and I got stuck on which one actually needed attention. When the news said Glasswing could automatically handle this kind of supply-chain risk, I was tempted too: it sounded like someone finally had maintainers’ backs.
What it actually solves, and who is using it
Glasswing is Anthropic’s software supply-chain security project. Its focus is not writing code for people, but identifying attacks that could come through third-party dependencies and helping maintainers take action. A public update says that, after seven months in operation, its results were weaker than expected, showing that there is still a gap between “automatically discovering risks” and “actually reducing incidents.” Security teams such as VulnCheck have continued tracking the results. It is a reminder that security tools have to fit into real maintenance workflows, not just demos.
What it costs to replicate today, and the first step
If I wanted this capability directly, the more realistic option today would be applying for beta access rather than building my own setup from news reports. Based on currently available public plans, the expected cost is 0 yuan, with about 2 hours of preparation. The technical barrier is being able to understand code repositories, dependency updates, and test workflows. The first step is to open Glasswing’s official project page, apply or join the waitlist, and export my dependency inventory at the same time. I wouldn’t change production just to chase a trend. I made that mistake, and after we focused only on upgrading, my colleagues spent three extra hours on regression testing that day.
How I would choose at different stages
If I were just starting out, mainly building websites or content services, I would keep automatic updates and assign one person to manually review them; there’s no urgency to try Glasswing now. With 1–2 clients, I would organize the dependency inventory, backups, and rollback steps before assessing whether to apply for beta testing. While scaling up, I would add supply-chain security to the delivery checklist and ask suppliers to explain how they handled risk discoveries. Not everyone needs this tool. If I weren’t maintaining any code at all, asking the hosting provider for a clear answer would probably save more time.