Anthropic Project Glasswing Initial Update: Claude Mythos Preview Finds Over 10,000 High-Severity Vulnerabilities

Anthropic's first public update on Project Glasswing reports that Claude Mythos Preview, used by roughly 50 partners, surfaced more than 10,000 high- or critical-severity vulnerabilities in the most systemically important software in a single month. The headline finding is not the raw bug count but a shift in the bottleneck: AI has made finding vulnerabilities vastly easier, while human capacity to verify, disclose, and patch them has become the limiting factor.

The core result: finding bugs is no longer the hard part

Project Glasswing is Anthropic's collaborative effort, launched a month before the update, to secure critical software before increasingly capable AI models can be turned against it. Its initial partners build and maintain software fundamental to the internet and other essential infrastructure.

After one month, most partners had each found hundreds of critical- or high-severity vulnerabilities in their own software, and collectively they found more than 10,000. Several partners told Anthropic that their rate of bug-finding increased by more than a factor of ten.

Anthropic states plainly that progress on software security used to be limited by how quickly new vulnerabilities could be found. It is now limited by how quickly vulnerabilities found by AI can be verified, disclosed, and patched.

Why Anthropic is not publishing full details yet

The software industry convention is to disclose new vulnerabilities 90 days after discovery, or around 45 days after a patch becomes available, so end users have time to update before attackers can exploit the flaw. Anthropic's own Coordinated Vulnerability Disclosure policy follows this approach.

Because of that window, Anthropic says disclosed vulnerabilities are a lagging indicator of AI cyber capability. The company is therefore publishing illustrative examples and aggregate statistics rather than full technical detail, and promises much more detail once patches for the vulnerabilities Mythos Preview found are widely deployed.

External evidence for Claude Mythos Preview's cyber capabilities

Anthropic cites several independent evaluations as evidence of Mythos Preview's performance:

The UK's AI Security Institute reports that Mythos Preview is the first model to solve both of its cyber ranges, which are simulations of multistep cyberattacks, end to end.
Mozilla found and fixed 271 vulnerabilities in Firefox 150 while testing Mythos Preview, more than ten times the number it found in Firefox 148 with Claude Opus 4.6.
XBOW, an independent security platform, reports that Mythos Preview is a "significant step up over all existing models" on its web exploit benchmark and provides "absolutely unprecedented precision" on a token-for-token basis.
ExploitBench and ExploitGym, two recently released academic benchmarks for measuring models' exploit development capabilities, both show Mythos Preview as the strongest performer. Anthropic discusses these in more detail on its Frontier Red Team blog.

Anthropic also cites partner-reported outcomes. Cloudflare found 2,000 bugs across its critical-path systems, 400 of them high- or critical-severity, with a false positive rate that Cloudflare's team considers better than human testers.

Downstream effects on patching across the industry

Anthropic reports that patched software is being rolled out much more quickly across the industry:

The latest Palo Alto Networks release included over five times as many patches as usual.
Microsoft reported that the number of new patches it releases will "continue trending larger for some time."
Oracle is finding and fixing vulnerabilities across its products and cloud multiple times faster than before.

Mythos Preview has also been used for defensive security work beyond vulnerability discovery. At one Glasswing partner bank, the model helped detect and prevent a fraudulent $1.5 million wire transfer after a threat actor compromised a customer's email account and made spoof phone calls.

Open-source scanning results

Anthropic has used Mythos Preview to scan more than 1,000 open-source projects that underpin much of the internet and much of Anthropic's own infrastructure.

Mythos Preview estimates it found 6,202 high- or critical-severity vulnerabilities in those projects, out of 23,019 total findings including those it estimates as medium- or low-severity.

Of the high- or critical-rated findings, 1,752 were carefully assessed by one of six independent security research firms, or in a small number of cases by Anthropic itself. The results:

90.6% (1,587) proved to be valid true positives.
62.4% (1,094) were confirmed as either high- or critical-severity.

Anthropic notes that even if Mythos Preview found no further vulnerabilities, at current post-triage true-positive rates it is on track to have surfaced nearly 3,900 high- or critical-severity vulnerabilities in open-source code, in addition to those found for Glasswing partners. Anthropic intends to keep scanning open-source code, so it expects that number to rise.

The wolfSSL example

One detected open-source vulnerability was in wolfSSL, an open-source cryptography library known for its security and used by billions of devices worldwide. Mythos Preview constructed an exploit that would let an attacker forge certificates, which could allow hosting a fake website for a bank or email provider that looks legitimate to an end user despite being controlled by the attacker. The vulnerability has been patched and assigned CVE-2026-5194; Anthropic says it will release a full technical analysis in the coming weeks.

The triage pipeline and its drop-off

Anthropic describes an intensive triage process: it or an external security firm reproduces the issue, re-assesses severity, checks whether fixes already exist, and writes a detailed report to the software's maintainers. Anthropic says it takes considerable care because maintainers already face a deluge of low-quality, AI-generated bug reports. Several maintainers said they are severely capacity constrained, and some asked Anthropic to slow its disclosure rate so they could design patches. On average, a high- or critical-severity bug found by Mythos Preview takes two weeks to patch.

Anthropic has published a dashboard tracking the open-source vulnerabilities it has scanned, showing each step of the disclosure process and the steep drop-off at every phase, which reflects the human effort required to verify and fix each finding.

Disclosure and patch counts so far

On maintainers' request, Anthropic sometimes discloses bugs directly without further assessment. It has reported 1,129 such unvetted bugs, of which Mythos Preview estimated 175 were high- or critical-severity.
Anthropic estimates it has disclosed 530 high- or critical-severity bugs to maintainers so far, based on Claude's severity assessment for direct disclosures and maintainers' or security partners' assessments where available.
A further 827 confirmed vulnerabilities, estimated as high- or critical-severity in the same manner, are awaiting disclosure.
75 of the 530 reported high- or critical-severity bugs have been patched, and 65 of those have public advisories.

Anthropic gives three reasons the patch count is still relatively low: the 90-day disclosure window is still early; some vulnerabilities are patched without a public advisory, so Anthropic is likely undercounting and relies on scanning for patches itself using Claude; and the low volume reflects a genuine problem, namely that even at a relatively slow pace of disclosure, Mythos Preview is adding to an already-overloaded security ecosystem.

Guidance for cyber defenders

Anthropic argues that models with cybersecurity skills similar to Mythos Preview will soon be more broadly available, and that the software industry needs a larger coordinated effort to manage the volume of findings these models will generate. The interim period, in which vulnerabilities are discovered rapidly and patched slowly, presents new risks.

The advice Anthropic gives is explicitly not new, and the company notes that many researchers, including at Anthropic, are working on better and more durable solutions. In the meantime:

Software developers should shorten patch cycles and make security fixes available as quickly as possible. Anthropic says thoughtful use of publicly available AI models can help, and that it is building tools and sharing research to support this. Developers should also make updates easy to install and be more persistent with users still running software with known vulnerabilities.
Network defenders should shorten patch testing and deployment timelines. Anthropic points to critical controls from the National Institute of Standards and Technology and the UK's National Cyber Security Centre, which improve security without depending on any single patch landing in time. These include hardening networks' default configurations, enforcing multi-factor authentication, and keeping comprehensive logs for detection and response.

Tools for cyberdefense with publicly available models

Anthropic notes that many generally available models can already find large numbers of software vulnerabilities, even if they cannot find the most sophisticated ones or exploit them as effectively as Claude Mythos Preview.

Claude Security is now in public beta for Claude Enterprise customers. It helps teams scan their codebases for vulnerabilities and can generate proposed fixes. In the three weeks since launch, Claude Opus 4.7 has been used to patch over 2,100 vulnerabilities. Anthropic attributes the faster pace, compared with open-source patching, largely to enterprises fixing their own code rather than relying on volunteer maintainers working through coordinated disclosure.
The Cyber Verification Program allows security professionals using Anthropic models for legitimate cybersecurity purposes, such as vulnerability research, penetration testing, and red-teaming, to do so without certain safeguards designed to prevent cyber misuse.

Anthropic is also making the tools it and its partners used with Mythos Preview available to qualifying customers' security teams on request, to reduce the setup needed to get the best performance out of highly capable public models. The release includes:

The skills (custom instructions for repeated work) that Anthropic and its partners built and shared.
A harness that helps Claude map the codebase, spin up scanning subagents, triage its findings, and write reports.
A threat model builder, which maps a codebase to identify potential targets for attack and prioritizes the model's work accordingly.

Cisco, a Project Glasswing partner, has also recently open-sourced its Foundry Security Spec to help other defenders build an evaluation system similar to the one Cisco uses.

Ecosystem support

Anthropic has formed a partnership with the Open Source Security Foundation's Alpha-Omega project, which will support the foundation's efforts to help maintainers process and triage bug reports. The Linux Foundation announced $12.5 million in grant funding from leading organizations to advance open-source security.

Anthropic also supported the development of ExploitBench and ExploitGym, the two new benchmarks for tracking frontier AI models' exploit development capabilities over time. It supports other quantitative benchmarks through its External Researcher Access Program, offers Claude for Open Source to maintainers and contributors, and commits to scanning any open-source package that Anthropic itself adopts in the future.

What's next for Project Glasswing

Anthropic states that no company, including Anthropic, has yet developed safeguards strong enough to prevent models as capable as Mythos Preview from being misused and potentially causing severe harm. That is why Anthropic has not released Mythos-class models to the public. It is also why Project Glasswing exists: if a similarly capable model were released without such safeguards, it would soon become dramatically cheaper and easier for almost anyone in the world to exploit flawed software.

Anthropic frames Glasswing as giving the most systemically important cyber defenders an asymmetric advantage, while stressing the urgent need for as many organizations as possible to shore up their cyber defenses. Its next steps are to work with critical partners, including US and allied governments, to expand Project Glasswing to additional partners, and, once far stronger safeguards are developed, to make Mythos-class models available through a general release.

Anthropic closes by describing the outcome it is working toward: a world in which important code is hardened far better than it is today and in which hacking is far less prevalent.