EVERYTHING
Anthropic is broadening access to its Project Glasswing program by adding approximately 150 organizations across 15 countries. This expansion allows the company's restricted Claude Mythos Preview model to be tested against a wider array of systems, including those underpinning critical infrastructure in sectors like power, water, healthcare, and communications.
According to Cyberscoop, the program began with an initial cohort of about 50 partners, which included major technology firms such as Google, Microsoft, NVIDIA, Amazon Web Services, and Cisco. The new group is particularly significant because many of these partners are vendors whose codebases support essential societal systems.
The Scale of AI-Driven Vulnerability Discovery
The sheer volume of flaws identified by the Mythos Preview model has drawn considerable attention across the security industry. Since its launch in early April, the program has surfaced over 10,000 high- or critical-severity software vulnerabilities. The effectiveness of the tool is demonstrated through several partner reports:
- Cloudflare identified 2,000 bugs within its critical-path systems, including 400 rated as high or critical, with a false-positive rate described as superior to that of human testers.
- Mozilla found and fixed 271 vulnerabilities in Firefox 150 while testing the model—more than 10 times the number discovered using an earlier Anthropic model on previous versions.
- Anthropic also utilized Mythos to scan more than 1,000 open-source projects, flagging a total of 23,019 potential vulnerabilities, with over 6,200 estimated as high or critical.
Of the 1,752 high- or critical-rated findings that were independently reviewed, more than 90% were confirmed as valid.
The Human Bottleneck in Cybersecurity
Despite the enhanced ability of AI to discover flaws at an unprecedented rate, Anthropic acknowledges significant challenges related to remediation. The company stated that the central issue is not detection but response time. “The bottleneck in fixing bugs like these is the human capacity to triage, report, and design and deploy patches for them,” the company noted in its blog post.
This limitation aligns with broader industry concerns. A joint report from the Cloud Security Alliance, SANS Institute, and OWASP concluded that organizations are "likely to be overwhelmed" by threat actors who use AI to find and exploit vulnerabilities faster than defenders can patch them. To mitigate misuse risks, Anthropic has confirmed it will not release Mythos-class models to the general public.
In the interim, the company released Claude Security, a product leveraging its publicly available Claude Opus 4.8 model, which successfully patched more than 2,100 vulnerabilities in three weeks. This expansion of Project Glasswing occurs amid political developments, including a scaled-back executive order signed by the Trump administration requiring AI developers to submit advanced models for government review up to 30 days before public release. The program’s continued growth signals a critical pivot toward using restricted AI tools as essential defensive infrastructure.