Glasswing first month report: AI discovered 10,000+ vulnerabilities, the security industry is facing a flood

Anthropic releases Project Glasswing's one-month initial update report: Claude Mythos Preview and about 50 partners discovered more than 10,000 high-severity vulnerabilities. Cloudflare discovered 2,000, Mozilla remediated 10x faster, and open source projects expect to find 3,900 high-severity vulnerabilities. The security industry has officially entered the era of AI vulnerability flood.

Core conclusion

On May 22, 2026, Anthropic released an initial update report for Project Glasswing, disclosing the results of its security AI model Claude Mythos Preview one month after it went online: more than 10,000 high-risk/severe-level vulnerabilities were discovered together with about 50 partners, of which Cloudflare alone discovered 2,000 vulnerabilities. Even more noteworthy, Anthropic scanned more than 1,000 open source projects with Mythos Preview and expected to find nearly 3,900 high-severity/critical vulnerabilities—90.6% of which were confirmed as actual true positives by external security research organizations.

Key Points

Time of incident: 2026-05-22
Impact target: cybersecurity industry, open source software maintainers, content creators and SaaS operators
Core change: The bottleneck in the field of software security has shifted from "discovering vulnerabilities" to "verifying and repairing vulnerabilities"

Background and trigger events

In April 2026, Anthropic launched Project Glasswing with about 50 partners. The goal is to use the Claude Mythos Preview model to preemptively discover and repair vulnerabilities in critical software around the world before AI capabilities reach a level available to attackers. An initial update a month later reveals the vast potential of AI in cybersecurity—and the new challenges that come with it.

Core Insight: The speed of vulnerability discovery is no longer limited by human labor, but by the speed of security team verification, disclosure and remediation. Mythos Preview has increased vulnerability discovery efficiency by more than 10x for some partners.

Key Impact (by Dimension)

Dimensions	Change	What it means to us	Recommended actions
Vulnerability discovery	AI model discovers >10,000 high-risk/severe vulnerabilities in a month	The supply volume of the security industry has increased sharply, and repair capabilities have become a bottleneck	Shorten the patch cycle and establish an automated vulnerability response process
Open source security	3,900 high-severity vulnerabilities are expected to be discovered in 1,000+ open source projects	The risk of open source components has increased sharply, and dependency management must be automated	Use AI-assisted dependency scanning tools to track CVE updates in a timely manner
Patch speed	Palo Alto patch volume increased by 5 times, Microsoft patch volume continues to grow	Security operation and maintenance team faces "patch flood"	Establish automated patch testing and deployment pipeline
Attack surface	Vulnerability remediation window remains unchanged, but discovery speed has increased 10 times	Attackers’ risk window for exploiting known vulnerabilities has expanded	Strengthen network default configuration, force MFA, and maintain complete log auditing
Anti-fraud	Mythos helps banks prevent a $150 million fraudulent transfer	AI has real value in the field of proactive defense	Incorporate AI models into anti-fraud and anomaly detection workflows

Adaptation suggestions

Impact on content operations and SaaS entrepreneurs

If you operate any platform that relies on open source components (such as n8n, Next.js, Node.js, etc.), you need to establish automated CVE tracking and patch update mechanisms now
The rapid improvement of AI security capabilities means: your automated workflow and AI Agent need stronger security audit links
The wolfSSL certificate forgery vulnerability (CVE-2026-5194) discovered by Mythos Preview shows that even seemingly secure encryption libraries may have vulnerabilities that can only be discovered by AI - don't assume "open source = security"

Task List

Check the dependent components of all online services to confirm that there are no known unpatched high-risk CVEs
Add security verification steps (such as output content detection, API key rotation) to automated workflows such as n8n
Pay attention to Anthropic’s subsequent opening of Glasswing security tools (skills, harness, threat model builder)
Evaluate the need to incorporate AI security auditing into content production pipelines

List of key data

Anthropic disclosed the following key data in the report, all derived from approximately 50 partners and more than a month of actual testing:

Cloudflare: 2,000 vulnerabilities discovered (400 high/critical) with better false positive rate than human testers
Mozilla: 271 vulnerabilities discovered and fixed in Firefox 150, 10 times more than the previous version
Palo Alto Networks: The latest version has 5 times the usual number of patches
Microsoft: Number of patches "will continue to grow"
Oracle: Vulnerability fixes "several times faster than before"
UK AI Security Institute: Mythos Preview is the first model to pass end-to-end across its two cyber ranges
Open Source Project: 530 high-risk/critical vulnerabilities have been disclosed to maintainers so far, 75 of which have been patched and 65 have received CVE numbers

— AI patch volume comparison

Related extended information

Tool entry (trigger tool floating card)

Tool and technology brands that appear naturally in the text: OpenAI, Claude, Anthropic, n8n, Next.js

Internal link guidance

Want to learn more about how to add safety and quality gates to automated workflows? Watch: How to add quality gates to your AI automation workflow: A practical guide from output to trustworthy results -Real case reference: A developer used AI Agent to build an automated system to achieve a monthly income of over 10,000——He Built an AI Automation Stack with Claude + n8n — $4K to $12K/mo in 6 Months