Anthropic Says Project Glasswing Found Thousands of Serious Software Flaws

Summary

Anthropic says Project Glasswing identified more than 10,000 high- or critical-severity vulnerabilities. The initiative also helped prevent a reported $1.5 million fraudulent transfer and is urging faster patching and stronger defenses.

Key points

Anthropic says Project Glasswing identified more than 10,000 high- or critical-severity vulnerability candidates across widely used software.
The article says 6,202 findings affect more than 1,000 open-source projects; later analysis validated 1,726 candidates as true positives, including 1,094 high- or critical-severity flaws.
A critical WolfSSL flaw, CVE-2026-5194, could enable certificate forgery and service impersonation; 97 findings were patched upstream and 88 advisories issued.
Anthropic says a partner bank used the model to prevent a fraudulent $1.5 million wire transfer after an unknown actor breached a customer's email account and made spoof phone calls.
Anthropic recommends faster patch testing and deployment, hardened default configurations, multi-factor authentication, and comprehensive logging.
Claude Mythos Preview remains unavailable to the public amid concerns about safeguards against large-scale misuse; Anthropic announced a Cyber Verification Program for legitimate security work.

Article Details

Event Type: Anthropic disclosed Project Glasswing’s AI-assisted discovery of more than 10,000 high- or critical-severity vulnerabilities in widely used software.
Impact: The findings include 6,202 vulnerabilities affecting more than 1,000 open-source projects; 1,726 candidates were validated as true positives, including 1,094 assessed as high or critical. A critical WolfSSL flaw (CVE-2026-5194) could enable certificate forgery and impersonation of legitimate services. The effort has led to 97 findings being patched upstream and 88 advisories issued. Separately, a Glasswing partner bank reportedly used the model to prevent a fraudulent $1.5 million wire transfer after an unknown threat actor breached a customer’s email account and made spoof phone calls.