Project Glasswing Deep Dive: How Anthropic's Elite Cybersecurity Consortium Actually Works
Project Glasswing deploys Claude Mythos Preview to find zero-days before attackers do. Here's how it works.
In this article
What is Glasswing?
The twelve founding partners are: Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks. These organizations collectively maintain the cloud platforms, enterprise software stacks, financial infrastructure, and networking hardware that most businesses run on. Their involvement is not symbolic. Each partner is actively running Mythos on their own production codebases and disclosing findings through coordinated vulnerability processes. An additional 40-plus organizations maintaining critical open-source infrastructure also received extended access.
Project Glasswing is Anthropic's response to a blunt fact: Claude Mythos Preview can find and exploit software vulnerabilities better than all but the world's most skilled humans. In weeks of testing, Mythos discovered thousands of critical zero-days in every major operating system, every major browser, and dozens of essential software projects. Some survived 20+ years of human review.
Rather than restrict this capability, Anthropic gave it to the defenders, fast. Consortium members get free access. Anthropic is committing $100M in usage credits to support the research preview period.
How It Works
A security team at Google or AWS uses Claude Mythos Preview via API. They point it at critical codebases. Mythos reads the code and autonomously writes exploits to verify vulnerabilities. No human steering, just raw frontier model capability.
When Mythos finds something, the team patches it quietly. Only after the patch is live does Anthropic publish details. Patches are hitting critical infrastructure right now.
What Mythos Found: Specific Examples
Three examples illustrate how wide the exposure is.
A 27-year-old TCP SACK vulnerability in OpenBSD's network stack had survived decades of review by some of the most security-conscious developers in open-source software. Mythos found it in a single run costing under $50 at API pricing, out of a batch of 1,000 runs totaling under $20,000. The flaw enabled remote denial-of-service and has since been patched. A 16-year-old H.264 codec vulnerability in FFmpeg, the library embedded in nearly every streaming platform and browser, was found in a separate batch costing approximately $10,000.
The most technically involved example was CVE-2026-4747, a 17-year-old FreeBSD vulnerability enabling unauthenticated root access over NFS. Mythos developed a working exploit autonomously, chaining multiple bugs through a return-oriented programming attack split across six sequential RPC requests. Earlier versions of Claude required human direction at each step. Mythos did not.
All findings follow a responsible disclosure timeline: vendors receive up to 90 days to patch, with a 45-day extension if needed. Professional security contractors independently validated 198 submitted reports, reaching 89% exact severity agreement and 98% agreement within one severity level. Anthropic estimates more than 1,000 additional critical-severity vulnerabilities remain in the disclosure queue.
Benchmark Numbers
Two comparisons put the capability gap in context.
On Firefox exploit development, Opus 4.6 produced 2 working exploits from several hundred attempts. Mythos Preview produced 181 working exploits plus 29 additional instances of register control in the same test environment. The 83.1% CyberGym score, where higher scores reflect successful exploit completion on real targets, compares to 66.6% for Opus 4.6.
On OSS-Fuzz testing across 7,000 entry points, Sonnet 4.6 and Opus 4.6 each produced 150 to 175 tier-1 crashes and approximately 100 tier-2 crashes, with a single tier-3 result each and zero tier-5 results. Mythos produced 595 tier 1-2 crashes and achieved tier-5 results on 10 fully-patched production targets. Tier-5 means full control flow hijack of a system security teams considered already hardened.
Anthropics stated explanation: these exploit capabilities were not explicitly trained into Mythos. They emerged as a downstream consequence of general improvements in code, reasoning, and autonomy.
The Race: Defenders vs. Attackers
AI vulnerability discovery is moving faster than human defenses can patch. Glasswing is Anthropic's bet that getting this capability to defenders first is the only viable strategy.
In 6-12 months, multiple labs will have models as capable as Mythos. In 2-3 years, even open-source models might match these capabilities. If only attackers have this automation, defenders lose. The race is on to flip the script, getting defenders the same tools first.
What This Means For You
If you maintain open-source software, 40+ organizations now have access to a frontier AI model to scan your repos. If you're on that list, you can request Mythos Preview access. The API cost is $0.
If you don't maintain critical infrastructure, Glasswing is still relevant: vulnerabilities being found and patched right now make your OS, browser, and cloud safer. The patch cycle is accelerating.
Mythos Preview is accessible through four platforms: the Claude API directly, Amazon Bedrock, Google Cloud Vertex AI, and Microsoft Foundry. Open-source maintainers outside the core consortium can apply separately through Anthropic's Claude for Open Source program.
The financial commitment goes beyond the $100M in usage credits. Anthropic committed $2.5M to Alpha-Omega and the Open Source Security Foundation and another $1.5M to the Apache Software Foundation, for a total of $4M in direct donations to open-source security organizations. After the research preview period ends, standard pricing will apply: $25 per million input tokens and $125 per million output tokens.
Sources & Further Reading
Anthropic's Project Glasswing | Anthropic Red Team: Mythos Preview | The Hacker News: Zero-Days Article | Official YouTube: Project Glasswing
Get the Claude playbook in your inbox.
One weekly email for Claude and Claude Code users. Real workflows, no hype. Subscribe and we send you The Claude Power-User Cheatsheet.
— ¶ —
Luke Thompson
Luke Thompson is the founder of The Operations Guide, LLC and editor of The Claude Insider. Based in Jonesborough, Tennessee, he has spent years building AI-augmented business systems and automation workflows for operators and teams. He began working with large language models in production well before the current wave of consumer AI tools, integrating them into client workflows, content pipelines, and operational infrastructure. At The Claude Insider, he writes about Claude with the specificity of someone who uses it daily as a professional tool — not as a reviewer or commentator, but as a builder. His coverage focuses on what actually works: prompt patterns, API integration strategies, agentic workflows, and the real-world tradeoffs that practitioners face. He is not affiliated with Anthropic, PBC.
Articles are researched and drafted with AI assistance, reviewed and edited by Luke Thompson.
Know where AI can pay off in your company.
Take the free two-minute AI Readiness Assessment. See your score, the two gaps holding you back, and the next move worth making.
