Skip to content

Back to the catalog

Project Glasswing: Initial Update (Anthropic)
anthropic.comarticle

Project Glasswing: Initial Update (Anthropic)

Anthropic's one-month progress report on Project Glasswing, where ~50 critical-infrastructure partners used Claude "Mythos Preview" to find over 10,000 high/critical-severity vulnerabilities, including a certificate-forgery flaw in wolfSSL (CVE-2026-5194). The post details disclosure statistics for 1,000+ scanned open-source projects (6,202 estimated high/critical bugs, 90.6% true-positive rate on triaged findings), benchmark results (UK AISI cyber ranges solved end-to-end, Mozilla finding 271 Firefox bugs, XBOW and ExploitBench/ExploitGym scores), and new defender tooling (Claude Security public beta, a Cyber Verification Program, threat-model-builder harness) aimed at addressing the growing gap between AI-accelerated bug discovery and human patch capacity.

TL;DR Anthropic's Project Glasswing update: Claude Mythos Preview has found 10,000+ high/critical vulnerabilities across partner and open-source codebases (including a wolfSSL cert-forgery CVE), and Anthropic is releasing Claude Security and new triage tooling to help defenders keep pace with AI-driven bug discovery.
Open original ↗

Organisations named here

  • Alpha Omega

CVEs named here

  • CVE-2026-5194

Technologies named here

  • wolfSSL
  • Claude Mythos Preview
  • Firefox 150
  • Claude Security
  • Firefox 148
  • Claude Opus 4.7
  • Palo Alto Networks products
  • Claude Opus 4.6
  • Microsoft products
  • Cyber Verification Program
  • Threat model builder
  • Oracle products and cloud
  • More than 1,000 open-source projects
  • Scanning/triage harness
  • ExploitBench
  • ExploitGym
  • XBOW
  • Foundry Security Spec
  • Claude for Open Source
  • External Researcher Access Program
  • Claude
  • Project Glasswing
  • Mythos

Techniques named here

  • Certificate forgery exploit
  • Cyber ranges
  • Automated large-scale vulnerability scanning of codebases

Threat actors named here

  • Unnamed threat actor

Related in AI Security