Glasswing Update: Mythos Found 10K+ Vulns

Anthropic published its first Project Glasswing progress report on May 22, 2026, and the headline figure is hard to sit with calmly. Claude Mythos Preview, the restricted cybersecurity-focused variant of Claude, uncovered over 10,000 high and critical severity vulnerabilities across major software in its first month of operation, per Anthropic's initial Glasswing update.

Ten thousand, in thirty days. For scale, the entire CVE database logged roughly 28,000 new entries across all of 2024, according to NIST's National Vulnerability Database. One AI system running for a month under controlled conditions surfaced a volume of serious flaws amounting to a meaningful fraction of what the global security community produces in a year.

The announcement went viral immediately, with Anthropic's post clearing a million views on X within hours. These are real vulnerabilities in real software, moving through real responsible-disclosure channels, which is a different category of claim from a benchmark score.

Mythos is a restricted model, and that is deliberate

We covered the initial Glasswing announcement in April. Briefly: Project Glasswing is Anthropic's initiative to apply AI to defensive cybersecurity, and Claude Mythos Preview is the specialized model at its center, tuned for vulnerability discovery, exploit analysis and security auditing.

Mythos is not publicly available. Access is restricted to vetted security partners, government agencies and approved researchers, and there is no API key to sign up for. A model that autonomously finds exploitable vulnerabilities in production software is dual-use by construction, and Anthropic's position is that the defensive value clears the risk only when access stays controlled.

The program page at anthropic.com/glasswing describes the structure: Mythos operates under strict responsible-disclosure protocols, with findings reported to affected vendors before any public acknowledgment. The 10,000-plus figure represents vulnerabilities already inside that disclosure pipeline rather than a raw scan count.

Discovery stopped being the bottleneck

Most of the breathless coverage skipped the part that matters. Finding vulnerabilities was never the hard problem. Fixing them is.

The security industry has operated for decades on the assumption that discovery is the scarce resource. Bug bounty programs, security audits, penetration testing firms: the entire ecosystem is built around the premise that finding flaws is slow and expensive, so the correct move is to incentivize more finding.

Mythos breaks that assumption in a single month. When one system surfaces 10,000 high-severity issues, the constraint moves violently downstream, into three places at once.

Vendor triage capacity comes first. Most software companies staff security teams to handle dozens or hundreds of incoming reports per quarter, not thousands per month, and volume alone can overwhelm a disclosure process regardless of finding quality. Patch development bandwidth is second, because every confirmed vulnerability needs a fix written, tested and shipped against finite engineering sprint capacity, and a flood of legitimate critical findings produces a prioritization problem with no good answer. Deployment lag is third and least tractable: enterprise adoption timelines have not moved, with large organizations still averaging 60 to 90 days to deploy critical patches per Qualys's annual reports, and that window is precisely where attackers operate.

Glasswing's most consequential contribution may end up being the pressure it puts on that structure. Our entire patching infrastructure was designed for a world where discovery was scarce, and that world just ended without anyone rebuilding the downstream capacity first.

Coordinated disclosure was not designed for this volume

Anthropic emphasizes that every finding goes through coordinated disclosure, which is both correct and the only survivable option. Releasing 10,000 unpatched vulnerabilities would be a catastrophe with Anthropic's name on it.

Disclosure at this scale generates its own problems. The standard 90-day timeline from vendor notification to public acknowledgment was designed for a handful of researchers submitting a handful of bugs. It has no defined behavior for one system generating findings faster than vendors can process them.

Three consequences are worth watching. Disclosure queues will back up, which means vendors could be carrying hundreds of unpatched flaws known to Anthropic at any moment, and every day that list sits raises the probability of parallel discovery by someone hostile. Prioritization pressure follows, because critical vulnerabilities are not equally exploitable and Anthropic will have to help vendors triage, which requires sharing enough technical detail to enable ranking without enabling exploitation. And government involvement is now in play, since the Japan reporting signals that nation-states read Glasswing-style capability as strategic, which will bring pressure to route findings through national CERTs and intelligence agencies and add another layer to an already strained process.

Japan is negotiating for access

On the same day as the Glasswing update, reporting from Nippon News indicated Japan is in negotiations for access to Anthropic's cybersecurity capabilities. The timing is not accidental.

Japan has spent two years expanding its cybersecurity posture in response to escalating threats against critical infrastructure and supply chains. Mythos-level vulnerability discovery would be a substantial upgrade to that toolkit, and pursuing it publicly says something about which AI partnerships Tokyo treats as strategic.

It also fits Anthropic's recent pattern of institutional deals: the $200 million Gates Foundation partnership, the $1.8 billion Akamai compute agreement, the SpaceX GPU lease. Glasswing gives Anthropic something no competitor currently offers, which is a proven operational AI cybersecurity capability that governments are actively asking for.

The geopolitical angle

This may matter more than the technical achievement. OpenAI has consumer distribution. Google has infrastructure. Anthropic is building a position as the AI company governments trust with sensitive security work, and if Glasswing's early results survive scrutiny, that position is considerably harder to replicate than a benchmark result.

Five gaps in the update

Anthropic's report is deliberately light on specifics, and that deserves stating plainly rather than glossing.

We do not know which software was scanned. "Major software" could mean operating systems, web frameworks, enterprise applications, open-source libraries or any mix, and the significance of 10,000 findings depends entirely on what was under examination.

We do not have a vulnerability type breakdown. Memory corruption, logic errors, authentication bypasses and API misconfigurations are very different findings, and the category distribution is what separates a genuine capability leap from a faster version of what static analysis already catches.

No false positive rate has been published. Ten thousand reported vulnerabilities means considerably less if the confirmed rate is 20%, and serious security teams will want precision and recall numbers before treating Mythos output at face value.

Overlap with known CVEs is unreported. How many findings are genuinely novel versus rediscoveries of known-but-unpatched issues matters, because both are useful and they demonstrate different things.

And no partner feedback has surfaced. The vendors receiving these disclosures have said nothing publicly, and whether they experienced useful signal or overwhelming noise will determine whether Glasswing scales past its first month. None of these gaps is a criticism of a first update, since responsible disclosure genuinely limits what can be published, but anyone citing the 10,000 figure should carry the caveats with it.

OSS-Fuzz took seven years to find 10,000 bugs

Anthropic is not alone in pointing AI at security. Google's Project Zero has used ML-assisted fuzzing for years. Microsoft's Security Copilot applies GPT-4-class models to threat analysis. Synack, Snyk and Wiz all use AI across various security workflows.

None has published results at this scale. The nearest comparison is Google's OSS-Fuzz, which has found roughly 10,000 bugs in open-source software over seven years of continuous operation. Mythos reported a comparable number in one month, and if that holds up under independent scrutiny the capability gap is large.

Autonomy is the differentiator. Most existing AI security tooling augments human researchers by flagging suspicious patterns, suggesting areas to investigate, or automating repetitive scans. Based on Anthropic's description, Mythos behaves more like an autonomous researcher: selecting targets, forming hypotheses about likely vulnerability classes, crafting inputs to test them, and validating what comes back. That is a change in kind rather than a change in throughput.

Three things that will decide whether this works

Vendor response times come first. The measure of Glasswing's impact is how fast disclosed vulnerabilities get fixed, not how many Mythos finds. A patching pipeline that cannot absorb the volume means the program manufactures risk while discovering it, and Anthropic will need to publish time-to-patch metrics for the program to be assessable at all.

Access expansion comes second. Japan appears to be first in the queue, and other governments and large enterprises will follow. How Anthropic manages that access list, and whether Glasswing partnerships are commercial or treated as a public good, will shape what the program becomes.

Adversarial response is third and least comfortable. If Mythos can find vulnerabilities at this rate, assume state-sponsored offensive teams are building equivalent capability, because AI-driven vulnerability discovery is inherently dual-use and the offensive version needs no disclosure protocol. The question is whether defenders can patch faster than attackers can exploit, and the current patching infrastructure was never built for this tempo.

The first Glasswing update is genuinely impressive, and the number worth tracking is the patch rate rather than the discovery count. Discovery without remediation produces a very expensive list of problems and no additional safety. Anthropic has built something that could shift the cybersecurity balance toward defense, contingent on the rest of the ecosystem keeping pace. That is an organizational problem rather than an AI one, and organizational problems are the harder category.