Anthropic Expands Project Glasswing and Claude Mythos Preview
Anthropic is expanding Project Glasswing to approximately 150 new organizations to secure critical global infrastructure. This expansion follows an initial phase where 50 partners used Claude Mythos Preview to identify over 10,000 high- or critical-severity security flaws in their codebases.
Scaling AI-Driven Vulnerability Detection
Project Glasswing aims to secure the world's most important software by providing trusted partners with access to Claude Mythos Preview. The expanded cohort includes organizations from over 15 countries across industries previously underrepresented, including healthcare, power, water, communications, and hardware. Many of these new partners are vendors whose codebases are relied upon by governments and other global organizations.
Anthropic estimates that a successful attack on the codebases of these partners could be catastrophic, potentially affecting more than 100 million people and impacting national and global security.
The Strategic Role of Claude Mythos Preview
Anthropic views the deployment of Mythos Preview as a necessary defensive measure against the inevitable arrival of "Mythos-class" models from other AI developers. The company predicts that within 6 to 12 months, similar models may be released without the safeguards necessary to prevent misuse, leading to more frequent and unpredictable cyberattacks.
To help the industry adapt, Anthropic is pursuing a two-fold strategy:
- Providing Defensive Tools: Anthropic has released "Claude Security," a product utilizing public frontier models like Claude Opus 4.8 to scan codebases and suggest patches. They are also providing specialized tools to trusted security teams to accelerate vulnerability discovery.
- Shifting Toward Remediation: The focus is moving from merely finding vulnerabilities to disclosing, fixing, and deploying patches. Mythos Preview is being used by partners to write patches, perform pre-release checks, conduct penetration testing, and rebuild legacy codebases in memory-safe languages.
Challenges in General Access and Safeguards
While Anthropic intends to release Mythos-level capabilities to the general public, they state that robust safeguards to prevent misuse have not yet been developed. Because cyber capabilities can be used for both defense and attack, creating precise and strong safeguards remains a significant technical challenge.
In the interim, Anthropic will continue expanding Project Glasswing, prioritizing critical infrastructure providers, open-source maintainers, and safety testers. They are also scaling their Cyber Verification Program to grant Mythos-class capabilities for specific cyberdefense tasks.
Community Perspectives and Critiques
Discussion among technical practitioners and observers reveals a divide between Anthropic's claims and real-world utility. Some users report that the model's output can be noisy, leading to a high volume of false positives that can overwhelm security teams.
"For us, it absolutely flooded us with noise... hundreds if not thousands of false positives or minor issues or not applicable. For every one reasonable issue... the biggest issue it created was the execs treated every issue it produced like it was a drop everything and fix the issue type deal."
Other critics suggest that the restricted rollout may be a strategic move rather than a safety necessity. Theories include:
- Compute Constraints: Some argue the limited access is a mask for an inability to serve the model at scale due to compute capacity.
- Marketing Strategy: Some view the "scarcity play" as a way to build hype and position the tool as a high-value enterprise product for the security market.
- Privacy and Sovereignty: Concerns have been raised regarding the handover of critical infrastructure source code to a single US-based company, with some suggesting this could facilitate government auditing of leaked sources.
Despite these critiques, some developers are independently exploring similar goals, such as using AI agents to port critical web infrastructure to memory-safe languages like Rust to eliminate entire classes of vulnerabilities.