> Anthropic's Project Glasswing is supposed to find them quite a while ago?

Someone still has to run it. The analysis and fix could be someone's machine but not committed / published.