Project Glasswing

Project Glasswing is a restricted-access cybersecurity program run by Anthropic that gives selected companies, open-source maintainers and government bodies early use of its most capable Claude models for defensive security work. Anthropic announced it on April 7, 2026, together with Claude Mythos Preview, a general-purpose model that the company said could find and exploit software vulnerabilities better than all but the most skilled humans and that it chose not to release to the public. The stated aim was to let the maintainers of widely used software find and patch flaws before models with similar abilities spread to attackers.^[1][2]

The program began with twelve launch partners, including Anthropic itself, and more than 40 additional organizations, backed by up to $100 million in Mythos Preview usage credits and $4 million in donations to open-source security groups.^[1] It was widened by roughly 150 organizations in more than 15 countries on June 2, 2026, moved its members to Claude Mythos 5 in June, and by September 2026 was admitting new members to Claude Mythos 5.1.^[5][9][30] Anthropic says Glasswing participants have found more than 10,000 high- or critical-severity vulnerabilities. Its public disclosure dashboard, which covers the open-source side of the effort, reported 2,300 vulnerabilities disclosed to maintainers and 421 known to be patched as of August 26, 2026.^[6][24][25] The program has been criticized for its opacity, for the slow pace of patching relative to discovery, and for favoring large technology firms, and it became a reference point in the September 2026 debate over the open-weight GLM-5.3 model.^{[20][21][24][38]}

Overview

Background and name

Anthropic said it formed Glasswing because of what it had observed in Mythos Preview, which it described as "a general-purpose, unreleased frontier model" showing that "AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities."^[1] The company's Frontier Red Team wrote that Mythos Preview had found thousands of high- and critical-severity vulnerabilities, including some in every major operating system and web browser, and that over 99% of them were still unpatched at the time of the announcement.^[2] On the CyberGym vulnerability-reproduction benchmark, Anthropic reported 83.1% for Mythos Preview against 66.6% for Claude Opus 4.6.^[1]

Three examples were published because they had already been fixed: a 27-year-old bug in OpenBSD that let an attacker remotely crash any machine running it, a 16-year-old flaw in FFmpeg in a line of code that automated testing had hit five million times, and a chain of Linux kernel vulnerabilities that escalated ordinary user access to full control of the machine.^[1] For unpatched findings, the Red Team published SHA-3 hash commitments so that it could later prove it had held the reports on a given date without revealing their content.^[2] It also reported that in 89% of 198 manually reviewed reports, expert contractors agreed exactly with the model's severity rating, and 98% were within one severity level.^[2]

The appendix of the announcement explains the name: the glasswing butterfly's transparent wings "let it hide in plain sight, much like the vulnerabilities discussed in this post," and also allow it to evade harm, "like the transparency we're advocating for in our approach."^[1]

Launch (April 2026)

Partners and access model

The April 7 announcement listed twelve launch partners: Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks.^[1][3] Anthropic said it had also given access to "a group of over 40 additional organizations that build or maintain critical software infrastructure" so they could scan both their own code and open-source systems.^[1] Anthropic later described this first cohort as "roughly 50 initial partners."^[5]

Partners were to use the model for tasks such as "local vulnerability detection, black box testing of binaries, securing endpoints, and penetration testing of systems."^[1] The $100 million in credits was meant to cover "substantial usage" during the research preview; after that, Mythos Preview would cost participants $25 per million input tokens and $125 per million output tokens through the Claude API, Amazon Bedrock, Google Cloud's Vertex AI and Microsoft Foundry.^[1] Open-source maintainers could apply through Anthropic's Claude for Open Source program.^[1] Linux Foundation chief executive Jim Zemlin wrote that the program "is designed to ensure that maintainers get access to these tools for free."^[4]

Anthropic committed to report publicly within 90 days on what it had learned and on the vulnerabilities fixed, and to work with security organizations on recommendations covering disclosure processes, software update processes, open-source and supply-chain security, secure-by-design practice, standards for regulated industries, and triage and patching automation.^[1] It said it had been in "ongoing discussions with US government officials" about the model, and suggested that "an independent, third-party body" might eventually be the right home for the work.^[1] A footnote announced "an upcoming Cyber Verification Program" for security professionals affected by new safeguards that would first ship on a less capable Opus model; that program later became the Anthropic Cyber Verification Program.^[1]

Partner statements

Partners' launch statements, published on Anthropic's page, described early use of the model. Microsoft's Igor Tsyganskiy said Mythos Preview showed "substantial improvements compared to previous models" on Microsoft's open-source CTI-REALM benchmark. Google's Heather Adkins said Google would make Mythos Preview available to participants through Vertex AI. Palo Alto Networks' Lee Klarich said the company had used it "to identify complex vulnerabilities that prior-generation models missed entirely."^[1] JPMorganChase's chief information security officer Pat Opet was more guarded, saying the bank "will take a rigorous, independent approach to determining how to proceed and where we can help."^[1]

Early government contact and the access incident

According to an Anthropic employee quoted by NBC News, the company "briefed senior officials across the U.S. government on Mythos Preview's full capabilities," including ongoing discussions with CISA and the Center for AI Standards and Innovation (CAISI).^[7] On April 21, 2026, Bloomberg reported that a small group of unauthorized users in a private online forum had been using Mythos Preview since the day it was announced. Anthropic told TechCrunch: "We're investigating a report claiming unauthorized access to Claude Mythos Preview through one of our third-party vendor environments," and said it had found no evidence that its own systems were affected.^[8]

Around the same time, The Paypers reported that Anthropic's head for the UK, Ireland and Northern Europe, Pip White, had said on Bloomberg Television that access would be extended to UK financial institutions, and that the UK's AI Security Institute had confirmed it had access to the model.^[10] On April 30, TNW, citing Bloomberg and The Wall Street Journal, reported that the White House had told Anthropic it opposed a plan to expand access from about 50 to about 120 organizations, citing misuse risk and a concern that Anthropic lacked the compute to serve that many users without degrading the government's own use of the model.^[11]

First results (May 2026)

In mid-May, Reuters reported (as relayed by Security Boulevard) that Anthropic had relaxed confidentiality terms so that members could share findings, tools and code outside the program. An Anthropic spokesperson said "there was never a specific Glasswing NDA" but that confidentiality protections "were something partners asked for" at the outset, and that the company had adapted them "to ensure key information can be shared broadly," including outside the program, "for maximum defensive impact."^[12]

On May 22, 2026, Anthropic published "Project Glasswing: An initial update." It said that "we and our approximately 50 partners have used Claude Mythos Preview to find more than ten thousand high- or critical-severity vulnerabilities," and that most partners had each found hundreds of such bugs, with several reporting bug-finding rates up by more than a factor of ten.^[6] The update argued that "progress on software security used to be limited by how quickly we could find new vulnerabilities. Now it's limited by how quickly we can verify, disclose, and patch" them.^[6]

For open source, Anthropic said it had scanned more than 1,000 projects, in which Mythos Preview estimated 6,202 high- or critical-severity vulnerabilities out of 23,019 findings of all severities. Of 1,752 high- or critical-rated findings assessed by one of six independent security firms (or occasionally by Anthropic), 90.6% (1,587) were true positives and 62.4% (1,094) were confirmed as high or critical.^[6] Anthropic estimated it had disclosed 530 high- or critical-severity bugs, of which 75 had been patched and 65 had public advisories. It gave three reasons for the low patch count: the 90-day disclosure window was still early, some fixes ship without advisories, and "Mythos Preview is adding to an already-overloaded security ecosystem." Some maintainers had asked Anthropic to slow its disclosures, and a high- or critical-severity Mythos finding took two weeks to patch on average.^[6] One highlighted example was a certificate-forgery flaw in the wolfSSL cryptography library, CVE-2026-5194.^[6]

The update also announced a partnership with the OpenSSF's Alpha-Omega project to help maintainers triage reports, said Anthropic had supported the development of the ExploitBench and ExploitGym benchmarks, and said the Glasswing scanning tools (skills, a scanning harness and a threat-model builder) would be offered on request to qualifying customers' security teams. It pointed to Claude Security, a scanning product in public beta for Claude Enterprise customers, with which Claude Opus 4.7 had been used to patch over 2,100 vulnerabilities in three weeks.^[6]

Expansion (June 2026)

At the start of June, Dark Reading reported that the European Commission had confirmed Anthropic's agreement to let ENISA, the EU cybersecurity agency, access Mythos, making it the first EU entity to do so, with terms still being negotiated. Commission spokesperson Thomas Regnier called the outcome "the result of the Commission's strong bilateral cooperation and engagement with Anthropic."^[13]

On June 2, 2026, Anthropic announced "Expanding Project Glasswing," extending the program to "approximately 150 new organizations" in more than 15 countries, each of which had to meet Anthropic's security requirements first. The new group covered sectors thin in the first cohort, "such as power, water, healthcare, communications, and hardware," and many were vendors whose code other organizations and governments depend on. Anthropic said that for most partners, "a major attack could affect more than 100 million people."^[5] It said it expected that "within 6 to 12 months" many other companies would have Mythos-class models, possibly without safeguards, and said it intended to shift its support "from finding vulnerabilities to disclosing, fixing, and deploying patched software."^[5]

Anthropic did not publish the list of new members.^[18] Reporting filled in parts of it:

TechCrunch, citing the FT, said the expanded group included organizations in Australia, Canada, France, Germany, Italy, Switzerland, the Netherlands, Spain, Belgium, Sweden, India, Japan, New Zealand and South Korea.^[14] Dragos chief executive Rob Lee told BankInfoSecurity that 15 to 20 of the company's vulnerability hunters had moved onto Mythos and that, because Dragos received a share of the credit pool, access "doesn't cost us anything."^[20]

Mythos 5 and the export-control suspension

On June 9, 2026, Anthropic released Claude Fable 5 to the public and Claude Mythos 5, the same underlying model with some safeguards lifted, to a narrower group. Mythos 5 "will initially be deployed through Project Glasswing, in collaboration with the US government, as an upgrade to Claude Mythos Preview," Anthropic wrote, and all existing Mythos Preview users could switch to it at $10 per million input tokens and $50 per million output tokens, less than half the Mythos Preview price.^[9]

Three days later the program was disrupted. On June 12 the US government applied export controls to Fable 5 and Mythos 5 restricting access by foreign nationals, and Anthropic, unable to verify nationality in real time, suspended both models for all users.^[22][23] Anthropic said the directive followed a report in which Amazon researchers had found a way to get Fable 5 to identify software vulnerabilities, and that its testing showed less capable models could find the same bugs.^[23] After the government's approval on June 26 it restored Mythos 5 to "a set of US organizations," and the controls were lifted on June 30; Anthropic said it was still coordinating with the government "to expand access to the broader set of domestic and international partners in the Glasswing program."^[23] In the same post it said it had begun drafting a shared framework for rating the severity of AI jailbreaks "together with Amazon, Microsoft, Google, and other Glasswing partners."^[23]

Disclosure dashboard

Anthropic maintains a coordinated vulnerability disclosure dashboard on its Red Team site that tracks the open-source findings from Mythos Preview, other Mythos-class models and other Claude models. When an external firm validates a finding, a SHA-3-512 hash of the sealed report is posted to a public ledger; the project, bug class and identifier are revealed only after the disclosure window closes.^[25] As of its August 26, 2026 update, covering findings discovered from November 1, 2025, the dashboard reported:^[25]

Anthropic notes on the page that disclosures are "a subset of the total number of vulnerabilities" found, because independent human triage is the rate-limiting step.^[25]

September 2026

On September 1, 2026, Anthropic released Claude Mythos 5.1 alongside the public Claude Fable 5.1. Mythos 5.1 is "available only through our trusted access programs," and Anthropic said it was "only available to a set of US organizations" while it worked with the US government on wider domestic and international access. Claude Security was also moved onto Mythos 5.1.^[17] The Cyber Verification Program at that point covered certain Opus- and Sonnet-class models, with Mythos-class access promised "in the near future."^[17] With Claude Opus 5.5 on September 22, Anthropic said the expanded CVP would have "three tiers for increasingly permissive trusted access, including access to Claude Mythos models."^[27]

New members continued to announce themselves. Checkmarx said on September 3 that it would use Claude Mythos 5 through the program; Rockwell Automation announced on September 15 that it had "controlled access to Claude Mythos 5" for industrial software; and Delinea said on September 17 that it was testing Claude Mythos 5.1 on its privileged-access code in an isolated environment.^[28][29][30]

On September 29, 2026, Anthropic's Frontier Red Team published an analysis of GLM-5.3, the open-weight model from Zhipu AI. The post said that releasing Mythos Preview through Glasswing had "enabled trusted cyber defenders to find more than 10,000 vulnerabilities in critical software, giving them a head start," and that similarly capable models "have now arrived." It reported that GLM-5.3 built end-to-end exploits in 50 of 410 ExploitBench attempts against 56 of 410 for Mythos Preview, and that its safeguards could be bypassed with simple techniques, including abliteration.^[24] It added that "through Project Glasswing (and other efforts, like Patch the Planet), cyber defenders have made meaningful progress," that vetted defenders "can now use even more advanced models like Claude Mythos 5.1 through our trusted access programs," and that GLM-5.3 "underscores the urgency of expanding access to advanced frontier models to a broader set of entities."^[24]

Related programs

Patch the Planet is not an Anthropic program. OpenAI describes it as "a Daybreak initiative built with Trail of Bits" in which security engineers review findings before they reach maintainers and help develop patches, with HackerOne and Calif assisting with triage and disclosure; initial projects included cURL, NATS Server, pyca/cryptography, Sigstore, aiohttp, the Go project, freenginx, Python and python.org.^[31][32] Its approach of pairing discovery with human triage and patch-writing addresses the bottleneck that Anthropic's own Glasswing updates identified.^[6][32]

Criticism and debate

Verifiability. From the start, outside researchers asked for more evidence. Heidy Khlaaf of the AI Now Institute warned on X against "taking these claims at face value" without data such as false-positive rates, NBC News reported.^[7] Bruce Schneier argued in May that other models are also strong at finding vulnerabilities, noting that the UK AI Security Institute found OpenAI's GPT-5.5 comparable and that the firm Aisle reproduced Anthropic's published results with smaller models, and suggested the restricted release "makes a virtue out of necessity" because Mythos is expensive to run.^[33] After the May update he called Glasswing "a fantastic PR move," said there was "something fishy about the data," and said Anthropic's refusal to release details "is a big problem here."^[21]

Mixed results from maintainers. curl lead developer Daniel Stenberg wrote on May 11 that a Mythos scan of curl reported five "confirmed" vulnerabilities, which his team reduced to one low-severity CVE, three false positives and one ordinary bug. He concluded that "the big hype around this model so far was primarily marketing," while noting that the report was well written and had "barely any false positives" among roughly twenty bugs.^[34]

The patching gap. In a September 8 analysis, VulnCheck counted 2,736 entries (10.5% of the 26,153 findings) in Anthropic's disclosure ledger, of which 202 were marked fixed, fewer than the 421 patched findings shown on the dashboard. For findings rated by both Claude and the maintainer, Claude had rated 91.5% as critical or high against 51.3% for maintainers, and 18 revealed findings had been patched before Anthropic reported them. VulnCheck concluded that "the receipts are starting to trickle in, they just don't reconcile."^[38]

Who gets access. In May, Nextgov/FCW reported "annoyance" among operational technology providers left out of the first round, citing four people familiar with the discussions.^[35] After the June expansion, BankInfoSecurity quoted critics who said Anthropic was picking winners and using Glasswing as a sales funnel; one unnamed executive noted that Sonicwall, Fortinet and Citrix, among the vendors most targeted by ransomware gangs, were not on the list. Dragos' Rob Lee disagreed that access gave his company a market advantage.^[20] Dark Reading reported that Action1's Gene Moody found CISA's apparent absence from the program concerning, while noting that Anthropic had not released the full member list.^[13] heise wrote that opinion was divided on whether the program was "clever PR before the planned IPO" or the best way to prepare for a security catastrophe.^[16]

Reaction to the GLM-5.3 post. Some commentators on X read the September 29 post as promotion for GLM-5.3. Andrew Case wrote that he was "very confused why Anthropic wrote a blog post advertising for cybersecurity teams to switch to GLM," and Harrison Kinsley (Sentdex) called it "a sales pitch and advertisement" for the GLM-5.3 family.^[36][37]

Timeline

See also

• Claude Mythos Preview
• Claude Mythos 5
• Claude Mythos 5.1
• Anthropic Cyber Verification Program
• GLM-5.3
• ExploitBench
• AI in cybersecurity
• Responsible Scaling Policy

References

1. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9 ^10 ^11 ^12 ^13 ^14 ^15 ^16 ^17 ^18 ^19 ^20 ^21 ^22 ^23 ^24 ^25 ^26Anthropic. "Project Glasswing: Securing critical software for the AI era." April 7, 2026. anthropic.com/glasswing
2. ^1 ^2 ^3 ^4Anthropic Frontier Red Team (Nicholas Carlini et al.). "Assessing Claude Mythos Preview's cybersecurity capabilities." April 7, 2026. red.anthropic.com/...mythos-preview
3. ^Anthropic. "Project Glasswing" (program page). Accessed September 30, 2026. anthropic.com/...glasswing
4. ^Jim Zemlin. "Introducing Project Glasswing: Giving Maintainers Advanced AI to Secure the World's Code." Linux Foundation, April 7, 2026. linuxfoundation.org/...ed-ai-to-secure-open-source
5. ^1 ^2 ^3 ^4 ^5 ^6 ^7Anthropic. "Expanding Project Glasswing." June 2, 2026. anthropic.com/...expanding-project-glasswing
6. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9 ^10 ^11 ^12Anthropic. "Project Glasswing: An initial update." May 22, 2026. anthropic.com/...glasswing-initial-update
7. ^1 ^2Jared Perlo and Kevin Collier. "Why Anthropic won't release its new Claude Mythos AI model to the public." NBC News, April 8, 2026. nbcnews.com/...ude-gets-limited-release-rcna267234
8. ^1 ^2"Unauthorized group has gained access to Anthropic's exclusive cyber tool Mythos, report claims." TechCrunch, April 21, 2026. techcrunch.com/...-cyber-tool-mythos-report-claims
9. ^1 ^2 ^3 ^4Anthropic. "Claude Fable 5 and Claude Mythos 5." June 9, 2026. anthropic.com/...claude-fable-5-mythos-5
10. ^"Anthropic to extend Project Glasswing access to UK financial institutions." The Paypers, April 20, 2026. thepaypers.com/...ess-to-uk-financial-institutions
11. ^1 ^2"White House opposes Anthropic's plan to expand Mythos access to 70 companies, citing compute and security concerns." TNW, April 30, 2026. thenextweb.com/...poses-anthropic-mythos-expansion
12. ^1 ^2"Anthropic Allows Glasswing Partners to Share Mythos-Based Findings." Security Boulevard, May 20, 2026. securityboulevard.com/...are-mythos-based-findings
13. ^1 ^2 ^3Jai Vijayan. "Anthropic to Open Mythos AI to EU's ENISA." Dark Reading, June 1, 2026. darkreading.com/...anthropic-mythos-ai-eu-enisa
14. ^1 ^2Rebecca Bellan. "Anthropic scales Claude Mythos to critical infrastructure in 15+ countries." TechCrunch, June 2, 2026. techcrunch.com/...l-infrastructure-in-15-countries
15. ^1 ^2"Canada has access to Anthropic's powerful Mythos AI model, minister says." Global News, June 2, 2026. globalnews.ca/...c-mythos-project-glasswing-canada
16. ^1 ^2"Securing Software: Anthropic opens 'Project Glasswing' for Europe." heise online, June 3, 2026. heise.de/...-Project-Glasswing-for-Europe-11316601
17. ^1 ^2 ^3 ^4Anthropic. "Introducing Claude Fable 5.1 and Claude Mythos 5.1." September 1, 2026. anthropic.com/claude-fable-and-mythos-5-1
18. ^1 ^2"Anthropic expands Mythos to 150 additional organizations in more than 15 countries." CNBC, June 2, 2026. cnbc.com/...anthropic-mythos-ai-project-glasswing
19. ^Greg Otto. "Anthropic expanding access to Project Glasswing." CyberScoop, June 2, 2026. cyberscoop.com/...cal-infrastructure-claude-mythos
20. ^1 ^2 ^3 ^4Shaun Waterman. "Anthropic Limits on OT Access to Mythos Draw Criticism." BankInfoSecurity (ISMG), June 12, 2026. bankinfosecurity.com/...hos-draw-criticism-a-31959
21. ^1 ^2Bruce Schneier. "Anthropic's Project Glasswing Update." Schneier on Security, June 8, 2026. schneier.com/...anthropics-project-glasswing-update
22. ^1 ^2Anthropic. "Statement on the US government directive to suspend access to Fable 5 and Mythos 5." June 12, 2026. anthropic.com/...fable-mythos-access
23. ^1 ^2 ^3 ^4 ^5Anthropic. "Redeploying Fable 5." June 30, 2026 (updated July 1, 2026). anthropic.com/...redeploying-fable-5
24. ^1 ^2 ^3 ^4 ^5 ^6Andrew Fasano, Marius Fleischer, Cole McFaul, Robert Xiao, Tripp Gallagher. "GLM-5.3 and the spread of advanced cyber capabilities." Anthropic, September 29, 2026. anthropic.com/...ad-of-advanced-cyber-capabilities
25. ^1 ^2 ^3 ^4 ^5Anthropic. "Anthropic's coordinated vulnerability disclosure dashboard." Last updated August 26, 2026. red.anthropic.com/...cvd
26. ^"Intercontinental Exchange Joins Anthropic's Project Glasswing." Intercontinental Exchange via AOL, June 3, 2026. aol.com/...hange-joins-anthropic-project-120000000
27. ^Anthropic. "Introducing Claude Opus 5.5." September 22, 2026. anthropic.com/claude-opus-5-5
28. ^1 ^2"Checkmarx Joins Anthropic's Project Glasswing." Checkmarx, September 3, 2026. checkmarx.com/...oins-anthropics-project-glasswing
29. ^1 ^2"Rockwell Automation Joins Anthropic's Project Glasswing to Advance AI-Enabled Cyber Defense for Industrial Critical Infrastructure." Rockwell Automation, September 15, 2026. rockwellautomation.com/...-Critical-Infrastructure
30. ^1 ^2 ^3 ^4"Delinea Joins Anthropic's Project Glasswing." GlobeNewswire, September 17, 2026. globenewswire.com/...anthropic-s-project-glasswing
31. ^1 ^2OpenAI. "Patch the Planet: a Daybreak initiative to support open source maintainers." June 2026. openai.com/...patch-the-planet
32. ^1 ^2 ^3Trail of Bits. "Introducing Patch the Planet." June 22, 2026. blog.trailofbits.com/...introducing-patch-the-planet
33. ^Bruce Schneier. "How Dangerous Is Anthropic's Mythos AI?" Schneier on Security, May 14, 2026. schneier.com/...-dangerous-is-anthropics-mythos-ai
34. ^Daniel Stenberg. "Mythos finds a curl vulnerability." daniel.haxx.se, May 11, 2026. daniel.haxx.se/...mythos-finds-a-curl-vulnerability
35. ^"Operational technology providers are feeling 'annoyance' at exclusion from Anthropic's Mythos rollout, sources say." Nextgov/FCW, May 4, 2026. nextgov.com/...413309
36. ^Andrew Case (@attrc). Post on X, September 29, 2026. x.com/...2105033855547613482
37. ^Harrison Kinsley (@Sentdex). Post on X, September 30, 2026 (UTC). x.com/...2105096311594766519
38. ^1 ^2Patrick Garrity. "The Anthropic Glasswing Receipts Are Starting to Trickle In." VulnCheck, September 8, 2026. vulncheck.com/...anthropic-glasswing-receipts