What did Anthropic's Project Glasswing find in its first month?

On 22 May 2026, Anthropic published its first update on Project Glasswing, the program in which selected organizations use Anthropic's unreleased model Claude Mythos Preview to find security flaws in critical software. According to Anthropic's update, Anthropic and about 50 partners found more than ten thousand high- or critical-severity vulnerabilities in the first month. Its conclusion: progress on software security is now "limited by how quickly we can verify, disclose, and patch the large numbers of vulnerabilities found by AI".

What is Project Glasswing?

Anthropic announced Project Glasswing on 7 April 2026 with eleven launch partners, among them Amazon Web Services, Apple, Google, Microsoft and the Linux Foundation. More than 40 other organizations that build or maintain critical software also got access. Anthropic committed up to $100 million in usage credits and $4 million in donations to open-source security organizations.

Mythos Preview is a general-purpose model. Anthropic keeps it out of general release because, in its own words, no company "has developed safeguards strong enough to prevent such models from being misused". At the launch, Anthropic gave three examples of flaws the model had found, all patched since:

• a 27-year-old flaw in OpenBSD that let an attacker crash any machine running it just by connecting to it
• a 16-year-old flaw in FFmpeg, in a line of code that automated tests had hit five million times without catching the problem
• several flaws in the Linux kernel, chained so that an ordinary user could take complete control of the machine

What did the partners find in the first month?

After one month, most partners had each found hundreds of high- or critical-severity vulnerabilities in their own software. Several told Anthropic that they now find bugs more than ten times as fast. Two examples:

• Cloudflare found 2,000 bugs in its critical-path systems, 400 of them high- or critical-severity, according to Anthropic's update. Its team rates the false-positive rate (findings that turn out not to be real bugs) better than that of human testers.
• Mozilla fixed 271 bugs that Mythos Preview found in Firefox 150. Anthropic says that is more than ten times what Mozilla found in Firefox 148 with Claude Opus 4.6.

The UK AI Security Institute reported on 13 May 2026 that a newer version of Mythos Preview was the first model to complete both of its cyber ranges, simulated attacks with many steps.

Anthropic does not detail the partners' findings yet. The industry convention is to disclose a vulnerability 90 days after it is found, or about 45 days after a patch appears, so that users can update first.

What did the scan of open-source projects show?

Anthropic also used Mythos Preview to scan more than 1,000 open-source projects. The model flagged 23,019 vulnerabilities and rated 6,202 of them high- or critical-severity. Six independent security firms, and in a few cases Anthropic itself, had assessed 1,752 of those by the time of the update:

• 90.6% (1,587) were real vulnerabilities
• 62.4% (1,094) were confirmed as high- or critical-severity

At that rate, Anthropic expects the scan to surface nearly 3,900 high- or critical-severity vulnerabilities in open-source code, even if the model finds nothing more. One example is wolfSSL, a cryptography library that Anthropic says runs on billions of devices. According to Anthropic, Mythos Preview built an exploit that would let an attacker forge certificates, for instance for a fake bank website that looks legitimate. The flaw is patched as CVE-2026-5194, its public ID. wolfSSL itself reports that the model's findings led to 8 CVEs and to the release of wolfSSL 5.9.1.

Why is patching now the bottleneck?

Every finding still passes through people. Anthropic or a partner firm reproduces the bug, reassesses its severity, checks whether a fix already exists and writes a detailed report for the maintainers. Those maintainers were already facing "a deluge of low-quality, AI-generated bug reports", and some asked Anthropic to slow down its disclosures.

By 22 May 2026, Anthropic had disclosed an estimated 530 high- or critical-severity bugs, with 827 more confirmed ones waiting. Of the 530, 75 were patched and 65 had a public advisory, a published security notice. Such a bug takes two weeks to patch on average.

Companies patch their own code faster. With Claude Security, a scanning tool in public beta for Claude Enterprise customers, Claude Opus 4.7 was used to patch more than 2,100 vulnerabilities in three weeks. Anthropic explains the gap largely by ownership: companies fix their own code, while open-source fixes usually depend on volunteer maintainers.

How do the scanning agents work?

Anthropic now offers the tools it and its partners used to qualifying customers' security teams, on request. The package holds skills (reusable instructions for recurring work), a threat model builder that maps a codebase to find likely targets, and a harness: the software around the model that hands out tasks and tools. It maps the codebase, starts scanning subagents, triages their findings and writes reports.

Cloudflare described its own harness on 18 May 2026, after pointing Mythos Preview at more than 50 of its repositories:

• about 50 "hunter" agents run at the same time, each looking for one class of attack in one part of the code, and each can compile and run proof-of-concept code in its own scratch directory
• an independent agent with a different prompt tries to disprove every finding
• a tracer agent checks whether input from an attacker can actually reach a confirmed bug from outside the system

Cloudflare found that one general coding agent pointed at a whole repository covers only a small part of the code, and that many narrow tasks in parallel cover more. When it let the model write its own patches, a few fixed the bug while quietly breaking something else.

Why is Mythos Preview not publicly available?

Anthropic expects many AI companies to build models as capable as Mythos Preview, and wants Glasswing to give the most systemically important defenders a head start. Security professionals doing legitimate work, such as penetration testing, can join the Cyber Verification Program to use Anthropic's public models without some of the safeguards against cyber misuse.

Cloudflare adds an observation from practice. In Glasswing, Mythos Preview runs without the extra safeguards of public models, yet it sometimes refused legitimate research tasks, and not consistently: the same task, framed differently, could get a different answer. Cloudflare concludes that these built-in refusals are not consistent enough to serve as a safety boundary on their own.

What should developers and defenders do now?

Anthropic's advice, which it calls not new:

• Software developers: shorten patch cycles, release security fixes as fast as possible, make updates easy to install and keep after users who still run versions with known vulnerabilities.
• Network defenders: shorten the time to test and deploy patches, and apply the basic controls from NIST and the UK's National Cyber Security Centre, such as hardened default configurations, multi-factor authentication and complete logs.

Anthropic notes that publicly available models can already find many vulnerabilities, if not the most sophisticated ones. Next, it plans to expand Glasswing to more partners together with the US and allied governments, and to release Mythos-class models generally once it has far stronger safeguards.