Reading Anthropic's First Update on Project Glasswing
Anthropic published a first update on Project Glasswing. With around 50 partners, Claude Mythos Preview found more than ten thousand high- and critical-severity vulnerabilities in a month. Here are three things from the update that stood out.
Insight 1: Over ten thousand high- and critical-severity bugs in a month
Cloudflare found 2,000 bugs (400 high- or critical-severity) across their critical-path systems, with a false positive rate that Cloudflare's team considers better than human testers. Mozilla found and fixed 271 vulnerabilities in Firefox 150 — over ten times more than they found in Firefox 148 with Claude Opus 4.6.
The update also says Mythos Preview tops the academic benchmarks ExploitBench and ExploitGym.
Insight 2: Patching is slower than finding
"Progress on software security used to be limited by how quickly we could find new vulnerabilities. Now it's limited by how quickly we can verify, disclose, and patch them."
Of the 530 high- or critical-severity bugs reported to maintainers, only 75 have been patched. Some maintainers asked Anthropic to slow down disclosures because they need more time to design patches.
Anthropic has partnered with OSSF's Alpha-Omega project to share the maintainers' triage load.
Insight 3: The model constructed a wolfSSL exploit itself
Mythos Preview constructed an exploit in wolfSSL that would let an attacker forge certificates — enabling, for instance, a fake banking or email website that looks legitimate to end users while being attacker-controlled. The vulnerability is now patched as CVE-2026-5194.
wolfSSL is a TLS library widely used in embedded devices. Anthropic says a full technical analysis will be published separately.
