More than 10,000 serious security findings sounds like an immediate win. It also sounds like a queue no security team can clear overnight. In Anthropic’s first Project Glasswing update, Claude Mythos Preview had helped roughly 50 partners find high- or critical-severity flaws. The harder story is what happens after discovery: validation, disclosure, patches and updates that actually reach users.
Update, 23 September 2026: The figures below describe Anthropic’s 22 May report, not a live total. Anthropic expanded Glasswing in June by inviting about 150 further organisations, and later Mythos releases have separate trusted-access rules. The original findings remain useful evidence for understanding the remediation bottleneck.
Glasswing is a security story with a practical deadline. Teams can search important code more quickly, but they still need people who can check reports and ship safe fixes. Anthropic argues that trusted defenders have a head start before similar tools spread more widely. That opportunity shrinks if the repair queue grows faster than teams can clear it.
What Anthropic reported from Project Glasswing
Anthropic published its initial Project Glasswing update on 22 May 2026. The company said it launched Glasswing the previous month as a collaborative effort to secure critical software before increasingly capable AI models can be used against it. Anthropic says Claude Mythos Preview and approximately 50 partners have found more than 10,000 high- or critical-severity vulnerabilities.
Many details are still private for good reason. Publishing a flaw before a fix reaches users can make attacks easier. Anthropic describes a common disclosure window of about 90 days after discovery, or 45 days after a patch is available. That is a convention, not a guarantee that every finding will be public on a fixed date. Anthropic later expanded Glasswing in June; the figures in this article still refer to its May update.
| Claim | Reported figure | Source status | What it means |
|---|---|---|---|
| Project partners | Approximately 50 | Anthropic-reported | Glasswing is not a single internal scan. It is a multi-organisation defensive effort. |
| Partner findings | More than 10,000 high- or critical-severity vulnerabilities | Anthropic-reported | The scale is large enough to stress normal triage and patching workflows. |
| Open-source projects scanned | More than 1,000 | Anthropic-reported | Anthropic is scanning widely used open-source code, not only partner-owned code. |
| Open-source total findings | 23,019 estimated vulnerabilities | Anthropic-reported | Includes estimated low, medium, high and critical findings before full validation. |
| Open-source high or critical estimates | 6,202 | Anthropic-reported | The most important subset for urgent security work. |
| Independently assessed high or critical estimates | 1,752 | Anthropic-reported | Findings assessed by six independent security research firms or Anthropic in a small number of cases. |
| Valid true positives among assessed findings | 1,587, or 90.6% | Anthropic-reported | Suggests the signal is high, though it applies to the assessed subset. |
| Confirmed high or critical among assessed findings | 1,094, or 62.4% | Anthropic-reported | Indicates many findings remained severe after review, but not all did. |
The most important sentence in Anthropic's update is not the biggest number. It is the observation that progress used to be limited by finding vulnerabilities, while now it is limited by how quickly humans can verify, disclose and patch the vulnerabilities AI finds.
Why this is different from another bug bounty story
Bug bounties, fuzzing, static analysis and elite manual review have all found important vulnerabilities for years. Glasswing is different because the claims sit at the intersection of scale, reasoning and exploit validation.
Cloudflare, one of the partner organisations, described Mythos Preview as a clear step forward rather than a small refinement. Cloudflare said the model stood out in two areas: constructing exploit chains and generating proofs. In practical terms, that means the model was not merely pointing at suspicious code. It could connect lower-level primitives into higher-severity exploit paths and test whether a suspected bug behaved as expected.
Mozilla offers a concrete result. In its Firefox 150 account, it says it fixed 271 flaws found in an early Mythos Preview test. Its earlier work with Claude Opus 4.6 led to 22 security-sensitive fixes in Firefox 148. The comparison is striking, though the two tests are not a controlled trial of the models under identical conditions.
| Organisation | Publicly reported result | Practical signal | Caveat |
|---|---|---|---|
| Cloudflare | 2,000 bugs found, including 400 high or critical, according to Anthropic's summary of Cloudflare's report | Mythos could produce useful findings across critical-path systems | Cloudflare's detailed false-positive rate is described qualitatively, not as a public percentage. |
| Mozilla | 271 Firefox vulnerabilities fixed in Firefox 150 after initial Mythos evaluation | Strong evidence that AI-assisted review can surface real browser bugs | Mozilla's own posts note the work required harnessing, steering and filtering models. |
| wolfSSL | 8 CVEs and wolfSSL 5.9.1 triggered by Mythos findings | A concrete cryptography-library example with shipped fixes | The public wolfSSL post is vendor-reported. |
| Palo Alto Networks | 26 CVEs representing 75 issues in one May advisory, versus usual volume below 5 CVEs in a month | AI-assisted review may increase security-advisory volume sharply | Palo Alto says this reflects frontier AI testing and broader process changes. |
| Microsoft | Larger Patch Tuesday releases expected for some time | Large vendors are preparing for a higher-volume disclosure environment | Microsoft does not attribute the change to one model. |
| Oracle | Monthly Critical Security Patch Updates starting in May 2026 | Patch cadence is changing in response to faster discovery | Oracle frames this as AI plus existing security operations. |
Which Project Glasswing findings were verified?
The open-source part of Glasswing is especially important because it points at supply-chain risk. Anthropic says it scanned more than 1,000 open-source projects that underpin much of the internet and its own infrastructure. The model estimated 23,019 total vulnerabilities, with 6,202 in the high- or critical-severity category.
Those are not all confirmed vulnerabilities. Anthropic says 1,752 high- or critical-rated findings have been assessed so far. Of those, 1,587 were valid true positives and 1,094 were confirmed as high or critical. Anthropic projects that, if no further vulnerabilities were found, current post-triage true-positive rates would put Mythos on track to surface nearly 3,900 high- or critical-severity open-source vulnerabilities, in addition to partner findings.
| Metric | Count | Percentage | Interpretation |
|---|---|---|---|
| Total estimated open-source findings | 23,019 | 100% | Full estimated pool across severity levels. |
| Estimated high or critical open-source findings | 6,202 | 26.9% of total estimated findings | Priority pool for urgent review. |
| Assessed high or critical-rated findings | 1,752 | 28.2% of the estimated high or critical pool | The reviewed subset so far. |
| Valid true positives in assessed subset | 1,587 | 90.6% of assessed findings | Strong signal if the assessed subset is representative. |
| Confirmed high or critical in assessed subset | 1,094 | 62.4% of assessed findings | Severe findings remain a majority after review. |
| Projected high or critical open-source findings at current rates | Nearly 3,900 | About 62.4% of 6,202 | Anthropic's forward-looking estimate based on current triage rates. |
This is the most defensible way to write the story: Anthropic is not saying every estimated finding is already confirmed. It is saying the confirmed subset is large and accurate enough to change the defender workload.
The wolfSSL case shows why the stakes are high
Anthropic highlighted one open-source example in wolfSSL, a widely used cryptography library. wolfSSL says Mythos findings generated 8 CVEs and triggered the release of wolfSSL 5.9.1. Anthropic says one now-patched issue, assigned CVE-2026-5194, involved certificate forgery risk that could allow an attacker to make a fake website appear legitimate to an end user.
A cryptography library can appear in phones, servers and devices far from the team that wrote it. A flaw therefore has many possible downstream users. The wolfSSL case shows why discovery alone is not enough: maintainers need a clear report, a safe patch and a release process that helps those users update. AI can feed that process, but it cannot replace it.
Benchmarks back the concern, but benchmarks are not the whole story
The UK AI Security Institute says Claude Mythos Preview and GPT-5.5 have substantially exceeded previous cyber time-horizon trends in its narrow cyber task suite. AISI also says a newer Mythos Preview checkpoint was the first model to complete both of its cyber ranges end to end.
The ExploitGym paper adds another piece. It defines exploitation as turning a vulnerability into concrete security impact, such as unauthorised file access or code execution. The benchmark includes 898 instances from real-world vulnerabilities across userspace programs, Google's V8 JavaScript engine and the Linux kernel. The paper reports that Claude Mythos Preview and GPT-5.5 were the strongest configurations, producing working exploits for 157 and 120 instances respectively.
| Evidence type | What it supports | What it does not prove on its own |
|---|---|---|
| Partner reports | AI-assisted scanning is producing real patches in real codebases. | It does not provide a universal false-positive rate across all code. |
| Open-source triage data | Anthropic has a large reviewed subset with high true-positive rates. | It does not mean every estimated finding is already validated. |
| AISI cyber ranges | Frontier models are improving on autonomous cyber tasks. | Lab ranges do not equal every real-world attack path. |
| ExploitGym | AI agents can turn some real vulnerabilities into working exploits. | Benchmark success does not directly translate to unrestricted real-world capability. |
| Vendor patching changes | Major vendors expect larger or more frequent patch work. | Not every increase is caused by Mythos alone. |
The responsible conclusion is not panic. It is that model-assisted vulnerability discovery is now credible enough that security teams should treat it as an operational planning issue.
The new bottleneck: triage, disclosure and patch delivery
Finding a vulnerability is only the first step. Someone still needs to decide whether it is real, how severe it is, whether it is exploitable in realistic conditions, which versions are affected, how to fix it, how to test the fix, how to disclose it, how to ship it and how to get users to update.
That is where Glasswing becomes a systems problem. A model can generate thousands of leads faster than a response team can safely process them. If maintainers receive low-quality reports, they drown. If high-quality reports arrive faster than patch teams can act, attackers may gain a map of what to study after patches ship. If disclosure is rushed, users may be exposed. If disclosure is too slow, risk remains buried.
| Workflow stage | Old constraint | New constraint if Glasswing scales | What leaders should change |
|---|---|---|---|
| Discovery | Scarce elite researchers and uneven scanner coverage | AI can generate many more plausible findings | Build model-assisted scanning into secure development lifecycles. |
| Validation | Confirming a small flow of reports | Confirming a flood of high-signal reports | Add repeatable reproduction, severity and exploitability workflows. |
| Disclosure | Coordinating a manageable set of vulnerabilities | Coordinating many simultaneous reports across dependencies | Strengthen coordinated vulnerability disclosure capacity. |
| Patching | Scheduled release trains and emergency fixes | Larger routine security releases | Prepare teams and customers for higher patch volume. |
| Prioritisation | CVSS score plus local context | CVSS plus exploitability, exposure, KEV status and asset criticality | Use risk-based patch queues rather than raw severity alone. |
| Customer adoption | Getting users to install updates | Getting users to handle more frequent updates | Invest in automated updates, exposure reduction and detection. |
How a Mythos finding becomes a security fix
A useful security workflow has a chain of custody. A triager records the affected component, version and reproduction steps without publishing an exploit. A maintainer checks severity in the product’s actual deployment context, then creates a fix and regression test. The project coordinates an advisory and release, while downstream users update their own copies. The final measure is not how many reports entered the queue but how many affected systems received a working patch.
This is why the open-source subset deserves careful treatment: 6,202 model-estimated high or critical findings became 1,094 confirmed high or critical findings within the 1,752 reviewed at that point. Both numbers matter, but they answer different questions. A team budgeting remediation capacity should plan for candidate review, false positives, disclosure coordination and upgrade adoption.
What defenders should do now
The near-term defensive playbook is not complicated, but it is operationally demanding. Security teams should assume discovery volume will rise, and that competitors, researchers and eventually attackers will have better tools for code reasoning and exploit development.
Begin with software an attacker can reach: public services, sign-in flows, parsers and admin tools. Include critical dependencies and update systems. Review AI findings against the real code and deployment context before treating them as confirmed. Mozilla’s experience shows how much work a large finding set can create for the team that has to fix it.
Second, widen patch capacity before the queue arrives. That means clear ownership for security fixes, faster test pipelines, release processes for emergency and routine patches, and an agreed standard for when a finding is credible enough to move.
Third, join up vulnerability management with exposure management. A high CVSS score is not always the same thing as immediate organisational risk, and a lower-scored bug in an exposed critical asset can be urgent. CISA's Known Exploited Vulnerabilities catalogue remains useful because exploitation in the wild is a strong prioritisation signal. FIRST's CVSS framework is also useful, but CVSS itself says consumers should enrich base metrics with threat and environmental context.
What Project Glasswing means for software security
Project Glasswing is a preview of a world where software security moves faster on both sides. Defenders may finally get tools that can find classes of bugs before attackers do. Attackers may eventually get similar capabilities. The difference will come down to whether serious software organisations can turn discovery into disciplined remediation faster than adversaries can turn discovery into exploitation.
Anthropic argues that finding flaws is becoming easier than fixing them. The early numbers and partner accounts make that concern credible, but there are limits to what readers can verify today. Many reports remain private while vendors patch. Some totals come from Anthropic’s own estimates. The useful lesson is to build capacity for triage, disclosure and updates now, then judge later claims against published fixes and independent review.
For now, the practical lesson is clear: AI-assisted vulnerability discovery is no longer a research curiosity. It is becoming a patch-management, software-supply-chain and executive-risk problem.
