Project Glasswing: How Anthropic Plans to Secure the World Using Mythos

AI models have crossed a threshold. They're now better than all but the most elite human security researchers at reading code, spotting vulnerabilities, and chaining exploits together. That's terrifying if those models are in the wrong hands. But it's revolutionary if they're in the right ones. (See also: why Anthropic delayed Claude Mythos) (See also: Claude Opus 4.7)

Mythos has already found thousands of zero-days in every major operating system and web browser — flaws that survived decades of human review, millions of automated scans, and the best efforts of dedicated security teams. A 27-year-old vulnerability in OpenBSD. A 16-year-old flaw in FFmpeg that automated tools had hit 5 million times without catching. Multi-stage kernel exploits that would take a human team months to discover. Mythos found all of them in weeks, often autonomously.

The initiative has three tiers: the launch partners (AWS, Apple, Google, Microsoft, etc.) are using Mythos internally to scan their own codebases and hardened systems. They're finding critical flaws and feeding fixes back to maintainers. Anthropic is giving these partners $100M in Mythos credits and funding open-source security organizations directly.

The second tier is 40+ additional organizations that maintain critical infrastructure — cloud providers, telecom companies, financial platforms. They get Mythos access to scan both their own systems and open-source dependencies. The third tier is the open-source community itself: maintainers of Linux, OpenBSD, major frameworks, and widely-used libraries can now use Mythos to harden their code before vulnerabilities become weaponized.

Compare that to Opus 4.6's 66.6% score. This isn't a marginal improvement — it's a leap that changes the economics of bug discovery.

AWS, Microsoft, Apple, and Cisco are months ahead of the public announcement. Their security teams have been running Mythos against their systems since February. Here's what they're reporting:

Glasswing is a "starting point," according to Anthropic. That's honest language. Finding every zero-day in critical infrastructure could take years. Frontier AI models will advance substantially in the next few months. Defenders have to act now, but they also know the war isn't won in the next quarter.

The second challenge: disclosure. When Mythos finds a 27-year-old bug in OpenBSD, you can't just publish it. Anthropic is using cryptographic hashes today and will reveal details only after patches ship. That's responsible. But it also means we're flying blind on what's actually been found.

If you work in infrastructure, DevOps, or cloud security: expect your vendors to announce Mythos-powered scanning tools in the next 2-3 months. This will become table stakes. If you're building security tools, you're either integrating Mythos or you're behind.

If you work in AI policy or governance: Glasswing proves that frontier capabilities, when properly deployed, create collective security benefits. This is the case for trusting frontier AI developers who actually think about safety — they can do things governments can't.

If you're a developer in open-source: your projects now have access to the world's most capable code auditor. Use it. Apply for Mythos credits. Get your critical libraries scanned.

Project Glasswing (Anthropic official) — The full deep dive with technical vulnerability details and partner quotes. Frontier Red Team Blog: Mythos' Vulnerability Discoveries — Technical breakdown of how Mythos found 27-year-old OpenBSD bugs and 16-year-old FFmpeg flaws. Reuters: White House and Anthropic CEO discuss working together amid rising fear about Mythos — Context on the government partnership. Cisco Security: Project Glasswing Announcement — Enterprise security perspective from a major launch partner.