In the first month of the project's operation, most partners discovered hundreds of critical or high-severity vulnerabilities, totaling over 10,000. According to a report from Cloudflare, they identified 2,000 vulnerabilities in critical systems, with 400 rated as high or critical severity, and their false positive rate is better than human testers.
“Our vulnerability discovery speed has increased more than tenfold.”
Anthropic
Additionally, a report from the UK AI Safety Institute noted that Mythos Preview is the first model to successfully address its two simulated cyber attack scenarios. During testing of Mythos Preview, Mozilla discovered and fixed 271 vulnerabilities, which is more than ten times the number found while using Claude Opus 4.6.
Enhancing Security in Open Source Projects
Anthropic has currently scanned over 1,000 open source projects using Mythos Preview, which are critical to the internet and its infrastructure. So far, Mythos Preview is estimated to have discovered 6,202 high or critical severity vulnerabilities in these projects, with 90.6% of the vulnerabilities confirmed as valid true positives.
“Even if Mythos Preview stops discovering new vulnerabilities, based on our current true positive rate, we expect to find nearly 3,900 high or critical severity vulnerabilities in open source code.”
Anthropic
For instance, Mythos Preview detected a vulnerability in wolfSSL that allows attackers to forge certificates, potentially enabling them to control a seemingly legitimate website. A detailed technical analysis of this vulnerability will be released in the coming weeks.
Future Prospects and Challenges
Despite the significant progress made by Mythos Preview in vulnerability discovery, the process of fixing these vulnerabilities remains constrained by human resources. Anthropic stated that while the discovery process has become easier, substantial human effort is still required for confirmation, reporting, and designing patches. At the request of maintainers, the disclosure speed of certain vulnerabilities has been slowed to allow them sufficient time to design remediation solutions.
Source: Anthropic Official Announcement
Anthropic officially announced that the initial progress of Project Glasswing indicates that the project aims to protect the world's most critical software from increasingly powerful AI models being used for attacks. Since its launch last month, Anthropic, along with about 50 partners, has discovered over 10,000 high or critical severity vulnerabilities using Claude Mythos Preview.
Goals and Partners of Project Glasswing
The primary goal of Project Glasswing is to enhance software security, particularly for systemically important software. According to official information, these partners are responsible for building and maintaining the software that underpins the internet and other critical infrastructures. Fixing defects in this code can reduce the risk for other organizations that rely on this software, thereby protecting billions of end users.
Data and Effectiveness of Vulnerability Discovery
In the first month of the project's operation, most partners discovered hundreds of critical or high-severity vulnerabilities, totaling over 10,000. According to a report from Cloudflare, they identified 2,000 vulnerabilities in critical systems, with 400 rated as high or critical severity, and their false positive rate is better than human testers.
“Our vulnerability discovery speed has increased more than tenfold.”
Anthropic
Additionally, a report from the UK AI Safety Institute noted that Mythos Preview is the first model to successfully address its two simulated cyber attack scenarios. During testing of Mythos Preview, Mozilla discovered and fixed 271 vulnerabilities, which is more than ten times the number found while using Claude Opus 4.6.
Enhancing Security in Open Source Projects
Anthropic has currently scanned over 1,000 open source projects using Mythos Preview, which are critical to the internet and its infrastructure. So far, Mythos Preview is estimated to have discovered 6,202 high or critical severity vulnerabilities in these projects, with 90.6% of the vulnerabilities confirmed as valid true positives.
“Even if Mythos Preview stops discovering new vulnerabilities, based on our current true positive rate, we expect to find nearly 3,900 high or critical severity vulnerabilities in open source code.”
Anthropic
For instance, Mythos Preview detected a vulnerability in wolfSSL that allows attackers to forge certificates, potentially enabling them to control a seemingly legitimate website. A detailed technical analysis of this vulnerability will be released in the coming weeks.
Future Prospects and Challenges
Despite the significant progress made by Mythos Preview in vulnerability discovery, the process of fixing these vulnerabilities remains constrained by human resources. Anthropic stated that while the discovery process has become easier, substantial human effort is still required for confirmation, reporting, and designing patches. At the request of maintainers, the disclosure speed of certain vulnerabilities has been slowed to allow them sufficient time to design remediation solutions.
Source: Anthropic Official Announcement