Anthropic Expands Project Glasswing After Claude Mythos Preview Flags 10,000+ Vulnerabilities
Summary
Anthropic is adding about 150 organizations across 15 countries to Project Glasswing after Claude Mythos Preview flagged more than 10,000 high- or critical-severity vulnerabilities. Over 90% of 1,752 reviewed findings were confirmed valid; triage and patching remain key
Key points
- Anthropic is expanding Project Glasswing to about 150 additional organizations across 15 countries, including partners in power, water, healthcare, communications, and hardware.
- Anthropic says Claude Mythos Preview has surfaced more than 10,000 high- or critical-severity vulnerabilities since the program launched.
- Cloudflare reported finding 2,000 bugs in critical-path systems, including 400 rated high or critical; Mozilla reported finding and fixing 271 vulnerabilities in Firefox 150 while testing the model.
- Anthropic scanned over 1,000 open-source projects, flagging 23,019 potential vulnerabilities; over 90% of 1,752 high- or critical-rated findings reviewed independently were confirmed valid.
- Anthropic says human capacity to triage, disclose, and patch vulnerabilities is now a key bottleneck.
- Anthropic says it will not release Mythos-class models publicly because it considers safeguards against misuse insufficient; it says Claude Security has been used to patch more than 2,100 vulnerabilities in three weeks.
Article Details
- Event Type
- Expansion of Anthropic's Project Glasswing program, which uses an AI model for vulnerability discovery
- Impact
- Anthropic is adding approximately 150 organizations across 15 countries. Claude Mythos Preview has identified more than 10,000 high- or critical-severity vulnerabilities; Anthropic reported that over 90% of 1,752 independently reviewed high- or critical-rated findings were valid. Cloudflare reported 2,000 bugs found, including 400 rated high or critical, and Mozilla said it found and fixed 271 vulnerabilities in Firefox 150. The article highlights the challenge of triaging, disclosing, and patching findings before attackers can exploit them; it reports no specific exploitation of these vulnerabilities.
Vendors
Products
Claude Mythos PreviewAnthropic is expanding its Project Glasswing program to about 150 more organizations across 15 countries after its Claude Mythos Preview model found more than 10,000 high- or critical-severity vulnerabilities.Claude Opus 4.8In the interim, it has released Claude Security, a product using its publicly available Claude Opus 4.8 model that has been used to patch more than 2,100 vulnerabilities in three weeks.Claude SecurityIn the interim, it has released Claude Security, a product using its publicly available Claude Opus 4.8 model that has been used to patch more than 2,100 vulnerabilities in three weeks.Firefox 150Mozilla found and fixed 271 vulnerabilities in Firefox 150 while testing the model, more than 10 times the number found in a previous Firefox version using an earlier Anthropic model.
Industries
CommunicationsAccording to the announcement, the new group covers sectors that were underrepresented in the first wave, including power, water, healthcare, communications, and hardware.hardwareAccording to the announcement, the new group covers sectors that were underrepresented in the first wave, including power, water, healthcare, communications, and hardware.HealthcareAccording to the announcement, the new group covers sectors that were underrepresented in the first wave, including power, water, healthcare, communications, and hardware.PowerThe results highlight both the power of AI-assisted bug discovery and the growing challenge of triaging, patching, and disclosing flaws before attackers can exploit them.waterAccording to the announcement, the new group covers sectors that were underrepresented in the first wave, including power, water, healthcare, communications, and hardware.