Anthropic's Project Glasswing identifies over 10,000 vulnerabilities, highlighting the challenges in patch verification and release.
Anthropic has unveiled the initial findings of Project Glasswing, a program dedicated to detecting security vulnerabilities using its Claude Mythos model.
In the span of just one month, around 50 collaborators pinpointed over 10,000 serious security flaws. The firm indicated that while detection speed was not an issue, challenges arose with the verification and deployment of patches.
The neural network reviewed more than 1,000 open-source projects, uncovering a total of 23,019 vulnerabilities, including 6,202 assessed as either "high" or "critical." After verification, 90.6% of these were confirmed, with 62.4% requiring immediate action.
Anthropic reported 530 major bugs to developers, with 827 more expected to be announced. So far, 75 vulnerabilities have been patched, and guidelines have been provided for an additional 65. On average, resolving a serious vulnerability takes about two weeks.
One notable public vulnerability identified was in the wolfSSL library (CVE-2026-5194), where the model demonstrated the ability to create an attack for certificate forgery.
Mozilla reported fixing 271 bugs in Firefox 150 following tests with Mythos, while Cloudflare found around 2,000 vulnerabilities, including 400 designated as "high" or "critical."
Anthropic has decided not to release the model to the public until enhanced safety measures are implemented, and it plans to broaden Project Glasswing with potential collaboration with the U.S. government and its allies.
Previously, in April, the company opted not to make Mythos publicly available due to significant security concerns. The neural network is also being used by the U.S. National Security Agency.
