Project Glasswing: An initial update

Anthropic’s Project Glasswing, announced last month, is a collaborative effort with roughly 50 partners to secure the world’s most critical software before increasingly capable AI models can be turned against it. Using the Claude Mythos Preview model, partners have identified more than ten thousand high‑ or critical‑severity vulnerabilities in the first month, with several reporting a more than ten‑fold increase in bug‑finding rate. Anthropic has also scanned over 1,000 open‑source projects, estimating 6,202 high‑ or critical‑severity vulnerabilities, of which 90.6% were confirmed true positives and 62.4% were confirmed high‑ or critical‑severity. The company’s coordinated vulnerability disclosure policy delays public details until patches are widely deployed, but it has already reported 530 high‑ or critical‑severity bugs, 75 of which have been patched and 65 have received public advisories. The average patch time for high‑ or critical‑severity bugs is two weeks, and the company notes that many more patches are expected as the 90‑day disclosure window progresses. Anthropic’s approach underscores the growing role of AI in vulnerability discovery while highlighting the bottleneck of human triage, reporting, and patch deployment in cybersecurity.