On 7 April 2026, Anthropic announced Project Glasswing, an initiative that gives a restricted group of technology companies and open-source maintainers access to Claude Mythos Preview, a frontier model that Anthropic says can find and exploit software vulnerabilities better than all but the most skilled humans. Rather than release the model generally, Anthropic limited it to defensive security work with partners including AWS, Apple, Google, Microsoft and the Linux Foundation. The decision made cybersecurity capability the reason for withholding a model, and six weeks later partners reported more than 10,000 high- or critical-severity vulnerabilities found with it. For developers, the main consequence is a much larger and faster flow of security patches.

Key Facts#

  • Launch partners: Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks, plus more than 40 other organizations that build or maintain critical software.
  • The model: Claude Mythos Preview is a general-purpose frontier model that Anthropic does not plan to make generally available. Anthropic said it found thousands of high-severity vulnerabilities, including in every major operating system and web browser.
  • Funding: Up to $100 million in usage credits, plus $4 million in donations: $2.5 million to Alpha-Omega and OpenSSF through the Linux Foundation and $1.5 million to the Apache Software Foundation.
  • Access and price: After the research preview, participants pay $25 per million input tokens and $125 per million output tokens, through the Claude API, Amazon Bedrock, Google Cloud's Vertex AI or Microsoft Foundry.
  • Benchmarks (vendor-reported): 83.1% on the CyberGym vulnerability reproduction benchmark, compared with 66.6% for Claude Opus 4.6.
  • Early results: In a 22 May 2026 update, Anthropic said it and about 50 partners had found more than 10,000 high- or critical-severity vulnerabilities.

What Happened#

Anthropic said it formed Glasswing because Mythos Preview showed that AI coding capability had crossed a threshold for security work. According to the company, the model found nearly all of the vulnerabilities in its showcase set, and developed many related exploits, without human steering. Three examples were already patched at launch: a 27-year-old flaw in OpenBSD that let an attacker remotely crash any machine just by connecting to it, a 16-year-old flaw in FFmpeg in a line of code that automated testing tools had executed five million times without catching the problem, and a chain of Linux kernel vulnerabilities that escalated ordinary user access to full control of the machine. For unpatched findings, Anthropic published cryptographic hashes of the details and promised to reveal them after fixes ship.

Anthropic expected partners to use the model for tasks such as local vulnerability detection, black-box testing of binaries, endpoint security and penetration testing. Anthropic committed to report publicly on lessons learned within 90 days and to work with security organizations on recommendations covering vulnerability disclosure, software updates, supply-chain security, secure-by-design development and patch automation. It said safeguards that would make Mythos-class models safe for broader release would first ship with an upcoming Claude Opus model.

The 22 May update added detail. Several partners reported their bug-finding rate had risen more than tenfold. Cloudflare found 2,000 bugs, 400 of them high or critical. Mozilla fixed 271 vulnerabilities in Firefox 150 while testing the model, and the UK AI Security Institute said Mythos Preview was the first model to solve both of its cyber ranges end to end. Scanning more than 1,000 open-source projects, the model flagged 6,202 findings it rated high or critical severity. Of 1,752 of those findings assessed so far, mostly by independent security firms, 90.6% were valid.

Background#

Anthropic had been warning about AI cyber capabilities for months, including its November 2025 report on an AI-orchestrated espionage campaign. Glasswing was its answer to a dilemma it describes openly: the capabilities that make such a model dangerous in the wrong hands also make it valuable for finding and fixing flaws, and Anthropic expects similar capabilities to spread to other developers soon.

The bottleneck quickly moved from discovery to repair. Anthropic said the limit on progress is now how fast humans can verify, disclose and patch what AI finds. Some open-source maintainers, already flooded with low-quality AI-generated reports, asked Anthropic to slow down its disclosures, and a high- or critical-severity bug found by the model took about two weeks to patch on average. The model family later reached general users through Claude Fable 5, whose rollout was briefly halted by US export controls.

Why It Matters for Developers#

Anthropic's own advice to software developers is to shorten patch cycles, ship security fixes quickly and make updates easy to install. Network defenders, it says, should shorten patch testing and deployment timelines and lean on controls that do not depend on any single patch, such as hardened defaults, multi-factor authentication and comprehensive logging. For .NET teams, that translates into a few concrete habits:

  • Automate dependency updates. Turn on NuGet Audit, keep an automated update bot running against your repositories and make sure your test suite gives you the confidence to merge updates quickly. The CI/CD with GitHub Actions guide covers pipeline hardening and automation.
  • Rebuild containers on a schedule. Base images pick up operating system and library fixes that your code never references directly.
  • Scan your own code with AI before attackers do. Generally available models can already find many vulnerabilities, even if not the most sophisticated ones. Pair AI review with the analyzers covered in the code quality guide and with the practices in the OWASP Top 10 for .NET guide.
  • Plan for disclosure spikes. When a widely used library ships several security fixes at once, you need an inventory that tells you quickly which services are affected. The supply chain security interview guide discusses SBOMs and dependency tracking.

What's Next#

Anthropic said it would keep scanning open-source code and expected its count of confirmed vulnerabilities to rise. On 2 June 2026, it expanded Glasswing to roughly 150 more organizations in more than 15 countries, adding sectors such as power, water, healthcare and communications, and said it expects many other AI companies to have Mythos-class models within 6 to 12 months. It has also partnered with OpenSSF's Alpha-Omega project to help maintainers triage reports, opened a Cyber Verification Program for security professionals and released Claude Security in public beta for enterprise customers. The larger question is what happens when models of similar capability come from other developers without comparable safeguards. In May, Anthropic said no company, including itself, had yet built safeguards strong enough to release Mythos-class models to the public, a position it revisited in June with the safeguarded Fable 5. It has also suggested that an independent third-party body could eventually host this kind of cross-industry security work.

Sources#