Anthropic’s Project Glasswing, announced last month, leverages the Claude Mythos Preview model to identify high‑severity vulnerabilities in critical software and open‑source projects. Within the first month, partners have uncovered more than ten thousand bugs, with several reporting a tenfold increase in discovery rates. The project has also scanned over 1,000 open‑source projects, estimating 6,202 high‑ or critical‑severity flaws, of which 90.6% are confirmed true positives and 62.4% are high‑ or critical‑severity. Patches are being released more quickly, with Palo Alto Networks issuing five times as many patches as usual and Microsoft and Oracle reporting larger patch volumes. However, the bottleneck remains human triage and patch development, averaging two weeks to patch a high‑severity issue. Anthropic has disclosed 530 high‑ or critical‑severity bugs to maintainers, with 75 patched and 65 publicly advised. The company continues to scan and disclose vulnerabilities, aiming to reduce risk for billions of end users while navigating the challenges of coordinated vulnerability disclosure and maintainers’ capacity constraints.
Project Glasswing: An initial update
Anthropic’s Project Glasswing, launched last month, uses the Claude Mythos Preview model to scan critical software and open‑source projects for high‑severity vulnerabilities. Over 10,000 bugs have been identified across partner systems, with a tenfold increase in discovery rates, and 6,202 high‑ or critical‑severity flaws found in 1,000 open‑source projects. The company reports a 90.6% true‑positive rate for assessed bugs and a 62.4% confirmation of high‑ or critical‑severity. Patches are being released faster, but the bottleneck remains human triage and patch development, with an average of two weeks to patch a high‑severity issue.
Why it matters
The rapid detection of vulnerabilities by AI models highlights both the potential for AI to strengthen cybersecurity and the need for robust human oversight in patching and disclosure processes.