5/22/2026↻ blog.updatedAt 6/24/2026

Project Glasswing: Claude Mythos Preview found thousands of vulnerabilities. What it means for companies

Realistický cover pro článek o Project Glasswing a AI hledání zranitelností

Anthropic published the first Project Glasswing update, and it deserves a separate article. Not because “AI found a lot of bugs.” The more important point is more concrete: AI models are starting to move from ordinary static scanning toward work that looks much closer to security research.

Project Glasswing is Anthropic’s initiative to secure critical software before similar AI capabilities are broadly used offensively. In its May 22, 2026 update, Anthropic says that roughly 50 partners used Claude Mythos Preview and collectively found more than ten thousand high- or critical-severity vulnerabilities in important software.

That is a strong signal. It also needs to be read precisely. AI is not a magic tool that solves security by itself. It massively expands the number of candidate findings. The new problem is not only finding a bug, but verifying it, reporting it correctly, fixing it and getting the patch to users.

Proces AI hledání zranitelností: hledání, kandidát, ověření a patch

What Project Glasswing showed

Anthropic published several important numbers. In the open-source part of the program, Mythos Preview reported 23,019 vulnerabilities, with an estimated 6,202 high or critical. In a manually reviewed sample of 1,752 findings, the true-positive rate was 90.6%. Anthropic says 530 high- or critical-severity bugs had been disclosed to maintainers and 75 had already been patched.

The partner results point in the same direction. According to Anthropic, Cloudflare found 2,000 bugs in critical-path systems, including 400 high or critical. Mozilla found and fixed 271 vulnerabilities in Firefox 150 while testing Mythos Preview. XBOW described Mythos Preview as a major step up in token-for-token precision.

These are not ordinary marketing numbers like “the model is 27% better.” They are operational numbers from a security workflow. That is why they matter.

Čísla z prvního update Project Glasswing: nálezy, závažnost, true positive a patche

Why this is different from a classic scanner

Traditional security scanners are useful, but they mostly work from known patterns: signatures, static rules, dependency databases, known CVEs and configuration checks. An AI security agent can do something different. It can try to understand application context, follow data flows, assemble an exploit path and produce a candidate vulnerability.

That does not mean the output is automatically true. The right mental model is: AI generates a suspicion, and a human or verification system turns it into a validated finding.

This distinction matters for companies. If you run AI as “another scanner” and let it generate tickets, you will create noise. If you put it into a process with triage, reproduction, severity scoring, disclosure and patch workflow, it can significantly expand the reach of a security team.

Practical implications

The first impact is clear: security backlogs will grow. Once AI starts finding more vulnerabilities, the bottleneck moves into verification and fixes. A company without a clear vulnerability-management process will be overloaded even by a good tool.

The second impact is the changing balance between attack and defense. The same capabilities that help defenders will eventually become available to attackers. Project Glasswing matters because it tries to fix critical software before that shift fully reaches the offensive side.

The third impact is for developers. Security review will increasingly look like working with an agent: the model reviews a change, finds suspicious paths, proposes an exploit or test, and a human decides what is actually relevant. That is especially useful in large codebases where no single person can keep all context in their head.

Risks and limits

The biggest risk is not that AI sometimes creates false positives. That can be handled with process. The bigger risk is that the model generates a large volume of partially correct findings without prioritization. Without triage, this turns into security spam.

The second risk is disclosure. Anthropic notes that public vulnerabilities are a lagging indicator because coordinated disclosure has to give users time to patch. That means the full scope of the model’s capabilities is not visible immediately, and it would not be safe to publish every detail.

The third risk is access. Mythos-class models are clearly dual-use. If a model can find and develop exploit paths, it is a powerful defensive tool, but also a sensitive capability. Companies should not treat systems like this as ordinary productivity AI without governance.

How I would deploy this inside a company

I would start with a safe scope. Not the entire production codebase at once, but one selected service, library or internal application. The goal is not “find as many issues as possible.” The goal is to measure how many findings are reproducible, how severe they are and how much triage time they require.

The process should look like this:

  • AI generates a candidate finding.
  • Security or a senior engineer verifies reproduction.
  • The finding receives severity and priority. - A patch is created, or there is an explicit decision not to fix.
  • The result is fed back into the next run.

Do not measure only the number of findings. Better metrics are true-positive rate, time to reproduce, time to patch, number of high/critical findings and the share of findings that actually changed the system’s risk profile.

Updated June 24, 2026: OpenAI Daybreak and GPT-5.5-Cyber

OpenAI has now opened a similar track under the name Daybreak. It is not the same program as Project Glasswing, but the direction is the same: AI is being used not just as a scanner, but as a research agent for finding, reproducing and fixing security issues.

Three details matter operationally. OpenAI introduced GPT-5.5-Cyber, a model trained for security work, and reports 85.6% on CyberGym. It also launched Patch the Planet, an open-source security program that is expected to expand toward projects such as Python, the Linux kernel and Apache HTTP Server. And for developers, it added Codex Security, a way to use Codex for security review, including vulnerability discovery, fix proposals and pull-request preparation.

For companies, the lesson is the same as with Glasswing, only now it is coming from more than one vendor. Security AI will not be just another CI check. It will generate suspicions, patch suggestions and reproduction steps. The value appears only when there is triage, service ownership, decision evidence and a clear audit trail above it. Otherwise a good tool becomes a faster generator of security tickets.

Practical conclusion

Project Glasswing shows that AI in security is no longer just autocomplete for a pentester. In a well-designed process, it can work as a scalable research assistant that finds candidate vulnerabilities at a breadth humans cannot cover manually.

For companies, the conclusion is simple: prepare the process before the tool. Without clear code ownership, patch workflow, triage and audit, stronger AI will not automatically make your software safer. It will simply show you faster where the process is broken.

Sources