Project Glasswing finds 10,000+ software vulnerabilities

Since its inception last month, Project Glasswing has fundamentally shifted the cybersecurity landscape. The primary bottleneck in securing software is no longer the discovery of vulnerabilities, but rather the human capacity to verify, disclose, and deploy patches for the sheer volume of issues identified by AI. This challenge highlights a critical interim period where rapid discovery outpaces the slower pace of remediation, potentially increasing risk for end users.

Mythos Preview’s Unprecedented Performance in Bug Detection

The early results from Project Glasswing’s partners and external testers demonstrate the remarkable efficacy of Claude Mythos Preview. Many partners report a tenfold increase in their bug-finding rate. For example, Cloudflare identified 2,000 bugs, including 400 high- or critical-severity issues, in its critical-path systems, with a false positive rate deemed superior to human testers. The UK’s AI Security Institute reports Mythos Preview as the first model to successfully navigate both of their end-to-end cyber range simulations. Mozilla also found and fixed 271 vulnerabilities in Firefox 150 using Mythos Preview, a significant increase compared to previous efforts. Independent security platform XBOW reports “unprecedented precision” from the model on its web exploit benchmark.

Beyond partner findings, Mythos Preview has scanned over 1,000 open-source projects, estimating 6,202 high- or critical-severity vulnerabilities. Of the 1,752 high- or critical-rated vulnerabilities subsequently assessed, 90.6% were confirmed as true positives, with 62.4% verified as high- or critical-severity. This includes a critical vulnerability, CVE-2026-5194, found in the widely used wolfSSL cryptography library, which could allow attackers to forge certificates.

Adapting to the New Cybersecurity Paradigm

The rapid advancement in AI-driven vulnerability discovery necessitates an industry-wide adaptation. Software developers and network defenders must adjust their practices to mitigate the risks posed by this new phase of cybersecurity. Key recommendations include:

1. Shorten Patch Cycles: Developers should prioritize making security fixes available as quickly as possible. Publicly available AI models can assist in this process, and tools like Claude Security are being developed to support these efforts.
2. Ease Update Installation: Software providers should simplify the process for users to install updates and be more proactive in notifying users running vulnerable software.
3. Accelerate Patch Deployment: Network defenders must shorten their timelines for testing and deploying patches.
4. Reinforce Critical Controls: Fundamental security practices, such as hardening default network configurations, enforcing multi-factor authentication, and maintaining comprehensive logs, become even more crucial as they enhance security independently of specific patches.

Anthropic has released Claude Security in public beta for Enterprise customers, a tool designed to scan codebases and propose fixes. In its first three weeks, Claude Opus 4.7, powering Claude Security, facilitated the patching of over 2,100 vulnerabilities. Additionally, the Project Glasswing tools used with Mythos Preview, including custom instructions, a code harness, and a threat model builder, are now available to qualifying security teams on request. Cisco, a Project Glasswing partner, has also open-sourced its Foundry Security Spec to aid other defenders in building similar evaluation systems.

The initial success of Project Glasswing underscores a profound shift in cybersecurity. While AI models like Mythos Preview are making vulnerability discovery vastly more efficient, the human element in verification and patching remains the critical bottleneck. The industry must collectively address this challenge to fully harness AI’s potential to build more secure software, transforming a period of increased risk into one of enhanced digital safety.