Project Glasswing: Securing critical software for the AI era

Anthropic's unreleased frontier model Claude Mythos Preview has found thousands of high-severity zero-day vulnerabilities across every major operating system and web browser. The model operates largely autonomously, identifying flaws that survived decades of human review and millions of automated security tests, representing a qualitative leap in AI-driven cybersecurity capabilities.

A cross-industry initiative bringing together 12 major launch partners including AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks, plus 40+ additional organizations. This unprecedented collaboration reflects the shared recognition that no single entity can address the cybersecurity challenges posed by AI-capable vulnerability discovery.

AI models have reached a threshold where the cost, effort, and expertise required to find and exploit software vulnerabilities have dropped dramatically. This means capabilities once limited to a few skilled security experts will soon proliferate to malicious actors, potentially making cyberattacks far more frequent and destructive—with current global cybercrime costs estimated around $500B annually.

Mythos Preview found a 27-year-old vulnerability in OpenBSD (one of the most security-hardened operating systems), a 16-year-old flaw in FFmpeg that automated tools had tested five million times without catching, and autonomously chained together multiple Linux kernel vulnerabilities to achieve full privilege escalation. These examples demonstrate the model's ability to find what decades of human and automated review missed.