Anthropic says Mythos found over 10,000 high- or critical-severity flaws in Project Glasswing’s first month
Summary
Anthropic says Project Glasswing identified over 10,000 high- or critical-severity vulnerabilities. Partner and evaluation results include Cloudflare and Mozilla findings, while Anthropic cites human triage and patching capacity as the main bottleneck.
Key points
- Anthropic says Project Glasswing identified more than 10,000 high- or critical-severity vulnerabilities in widely used code during its first month.
- Cloudflare reported finding 2,000 bugs across critical-path systems, including 400 rated high or critical.
- Mozilla said it found and fixed 271 vulnerabilities in Firefox 150 while testing Mythos Preview; the UK AI Security Institute said the model solved both of its cyber ranges end to end.
- In scans of more than 1,000 open-source projects, Mythos flagged 23,019 potential vulnerabilities; over 90% of 1,752 reviewed high- or critical-rated findings were confirmed valid, according to Anthropic.
- Anthropic says human capacity to triage, report, and patch issues is the main bottleneck; it also described low-quality AI-generated bug reports as a challenge for maintainers.
- Anthropic says it has not publicly released Mythos-class models because safeguards against serious misuse are not ready. Claude Security is in public beta for enterprise customers, and the company has started a Cyber Verification Program.
Article Details
- Event Type
- Anthropic reported that Project Glasswing and Mythos Preview identified more than 10,000 high- or critical-severity vulnerabilities in widely used code during the initiative’s first month.
- Impact
- Partner reports and evaluations included 2,000 bugs found across Cloudflare critical-path systems, 271 vulnerabilities Mozilla said it found and fixed in Firefox 150, and more than 90% of 1,752 reviewed high- or critical-rated findings confirmed as valid. Anthropic identified human capacity to triage, report, and patch findings as the main bottleneck. The company said Mythos-class models are not publicly released because safeguards against serious misuse have not been developed.
Vendors
Products
Claude Mythos PreviewThe UK AI Security Institute said Mythos Preview solved both of its cyber ranges end to end.Claude Opus 4.7has been used to patch more than 2,100 vulnerabilities in three weeks using the publicly available Claude Opus 4.7, and has begun a Cyber Verification Program for security professionals.Claude SecurityIn the interim, it has released Claude Security in public beta for enterprise customers, which it said has been used to patch more than 2,100 vulnerabilities in three weeks using the publicly available Claude Opus 4.7,Firefox 148Mozilla said it found and fixed 271 vulnerabilities in Firefox 150 while testing the model, more than 10 times the number found in Firefox 148 using an earlier Anthropic model.Firefox 150Mozilla found and fixed 271 vulnerabilities in Firefox 150 while testing the model.
Countries
United KingdomThe United Kingdom’s AI Security Institute found that Mythos Preview was the first model to solve both of its cyber ranges — simulations of multistep cyberattacks — from end to end.United StatesThe company said it plans to expand Project Glasswing with additional partners, including U.S.