Project Glasswing: securing critical software with Claude Mythos Preview

2026-04-07 · Publisher : Anthropic · Domain : Artificial Intelligence

Anthropic launches Project Glasswing, a cyber defense program giving vendors and maintainers of critical software restricted access to Claude Mythos Preview. Within seven weeks, more than 10,000 serious flaws are found.

On April 7, 2026, Anthropic announces Project Glasswing, a collaborative program to secure the world's most critical software. It relies on Claude Mythos Preview, a model whose offensive capabilities are deemed too sensitive for public release (see the "Claude Mythos Preview" entry of the same day). This entry covers the program itself. ### What happened - Founding partners are AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks, joined by about forty organizations that maintain critical software. - Anthropic commits 100 million USD in Mythos Preview usage credits, 2.5 million USD to Alpha-Omega and OpenSSF (via the Linux Foundation) and 1.5 million USD to the Apache Software Foundation. - Examples cited at launch: a 27-year-old flaw in OpenBSD and a 16-year-old bug in FFmpeg, missed after five million automated test runs. ### Key figures (May 22, 2026 update, Anthropic data) | Metric | Value | |---|---| | High- or critical-severity vulnerabilities found by partners | over 10,000 | | Open-source projects scanned by Anthropic | over 1,000 | | Estimated high or critical flaws in those projects | 6,202 | | True positive rate (1,752 flaws assessed by third parties) | 90.6% | | Flaws disclosed to maintainers / patches shipped | 530 / 75 | | Flaws found by Mozilla in Firefox | 271 | Cloudflare reports 2,000 bugs, 400 of them high or critical severity. ### Expansion On June 2, 2026, Anthropic opens the program to about 150 additional organizations in more than 15 countries, from underrepresented sectors: power, water, healthcare, communications, hardware. ### Caveats According to Anthropic, "finding them in the first place has become vastly more straightforward": the difficulty shifts to verification and patching. A patch takes two weeks on average to deploy, and some maintainers have asked for a slower disclosure pace. ### Key takeaways Glasswing introduces a restricted, defensive access model for offensive-capable models. It anticipates the arrival of cheap models with comparable cyber capabilities.

Tags : IA, Anthropic, Cybersécurité, Mythos, Open Source, Accès restreint