Anthropic says its restricted-access Claude Mythos Preview model has identified more than 10,000 software vulnerabilities rated high or critical severity while analyzing open-source projects, according to the company’s first progress report on Project Glasswing, its coordinated security program with major technology companies.
The report, published in late May 2026, says the model reviewed more than 1,000 open-source projects. Anthropic says independent auditors confirmed roughly 91 percent of the findings they examined, a validation rate the company presents as evidence that frontier models can now do vulnerability discovery at a scale that was previously impractical.
What Project Glasswing is
Anthropic launched Project Glasswing in April 2026 alongside the announcement of Claude Mythos Preview, a model the company has declined to release publicly because of what it describes as the model’s offensive cyber capabilities. Instead, Anthropic gave access to a group of launch partners, including Apple, Microsoft, Google, Amazon Web Services and the Linux Foundation, so they could use the model to find and fix flaws in their own code and in widely used open-source software before attackers could exploit them.
IBM joined the program on May 19, bringing the number of participating companies beyond the original 12 partners. Anthropic has said it expects to expand access further and eventually to release a model with comparable capabilities under safeguards.
A patching bottleneck
The company’s report also acknowledges a problem of its own making. Finding flaws has become far faster than fixing them, and several outlets covering the update noted that maintainers of open-source projects are struggling to keep up with the volume of reports. Anthropic says it is working with partners on triage and on tooling that could help automate parts of the repair process.
Skeptics question how unique the result is
Not everyone in the security industry treats the numbers as a breakthrough. Critics, including an executive at the cybersecurity company Aisle, argued in coverage of the report that cheaper open-source models can find many of the same classes of bugs, and that Anthropic’s results may reflect capabilities that will soon be commonplace rather than a singular technical advance.
The debate points to the question now facing the software industry: whether security will remain primarily a human discipline assisted by tools, or shift toward systems in which AI models find, analyze and eventually patch vulnerabilities with limited human involvement.
