Anthropic Project Glasswing update: AI discovers over 10,000 high-risk vulnerabilities in one month
Anthropic released the first month results of Project Glasswing: Claude Mythos Preview found more than 10,000 high-risk vulnerabilities, and 90.6% of open source software was confirmed to be real and effective. AI security auditing moves from proof-of-concept to production.
Core conclusion
On May 22, 2026, Anthropic released a phased results update for Project Glasswing. Only one month after its launch, the Claude Mythos Preview model has discovered more than 10,000 high-risk or critical vulnerabilities together with about 50 partners, covering the Internet's most critical infrastructure software. Meanwhile, Mythos Preview's scans of more than 1,000 open source projects found a cumulative 23,019 vulnerabilities, of which 6,202 were assessed as high or critical.
Core changes: AI discovers vulnerabilities far faster than humans can patch them—"verification, disclosure, and repair" have become the new bottleneck. This is both a challenge and an opportunity for the software security ecosystem.
Key Points
- Event Time: 2026-05-22 (officially released by Anthropic)
- Scope of Impact: Global software security ecosystem, open source maintainers, enterprise security teams
- Core Signal: The practical capabilities of AI in the field of cybersecurity have far exceeded most people’s expectations, and security practitioners must re-evaluate threat models and response speeds
Background and trigger events
In April 2026, Anthropic officially launched Project Glasswing - a joint effort with approximately 50 partners to leverage the power of the Claude Mythos Preview model to harden the security of the world's most critical infrastructure software before AI can be exploited for malicious purposes. Anthropic has previously emphasized that Mythos Preview has reached new heights in network security capabilities.
This May 22 update is Glasswing’s first official results report since its launch, and for the first time makes public actual usage data from partners and external third-party verification results.
Key Impact (by Dimension)
| Dimensions | Change | What it means to us | Recommended actions |
|---|---|---|---|
| Vulnerability discovery efficiency | Some partners have increased vulnerability discovery speed by more than 10 times | AI-assisted code auditing is no longer a proof-of-concept, but can be put into production | Integrate AI security scanning tools into the development pipeline as soon as possible |
| Open source software security | Mythos scanned 1,000+ projects and found 23,019 vulnerabilities, 90.6% were effective true positives | The open source libraries you rely on may have unpatched vulnerabilities | Check the vulnerability reports that the project depends on to shorten the patch cycle |
| Patch cycle pressure | Each high-risk vulnerability takes an average of 2 weeks to patch | The speed of discovery is faster than the speed of repair, and the attack window period is lengthened | Establish an automated patch CI/CD pipeline to shorten the test deployment cycle |
| Enterprise Security Practices | Cloudflare discovers 2,000 vulnerabilities with Mythos, with false positive rate better than human testers | The role of human security auditors is shifting from "finding vulnerabilities" to "classifying and remediating" | Redefining the workflow and staffing of security teams |
| Financial security practice | Assisted a cooperative bank to prevent a fraudulent transfer of $1.5 million | AI is not only used for code audits, but can also directly participate in real-time security defense | Introducing AI security assistance in sensitive business links |
Adaptation suggestions
Implications for content production teams
An intriguing detail from Anthropic's Glasswing project: Mozilla found 271 vulnerabilities in Firefox 150 using Mythos Preview, 10 times more than Claude Opus 4.6 found in Firefox 148. This means that model capabilities are experiencing leaps and bounds in the security field. For teams that rely on AI Agents for content automation, you can expect the same jump in capabilities to occur with content accuracy, security, and consistency.
Executable points
- Review your tool chain: Assess the security of the AI technology stack you use in the following dimensions: code auditing, dependency management, permission control
- Updated Security Policy: A Mythos-level model means vulnerability discovery is no longer a scarce resource—the real scarcity is the ability to fix quickly. Establish automated quality gates and patch pipelines
- Focus on the Dilemma of Open Source Maintainers: Reports indicate that some open source maintainers have explicitly requested Anthropic to slow down disclosures (because they need more time to design patches). If you rely on critical open source projects, consider making a donation or contributing labor
Example: Real vulnerability case of Mythos Preview
Mythos Preview discovered a high-risk vulnerability in wolfSSL, an open source encryption library used by billions of devices: AI successfully built attack code that exploited this vulnerability. An attacker can forge certificates and allow users to access seemingly normal banking or email service websites, but are actually controlled by the attacker. The vulnerability has since been patched (CVE-2026-5194), but this incident clearly demonstrates that AI is capable of combat-grade exploits.
Next action
- Want to learn how to use AI to build automated workflows? See: AI Agent drives automated website operations: Build a fully automatic content pipeline in 30 minutes
- Real case: Independent developer earns thousands of dollars a month using AI Agent——18-Year-Old Built a $5,000/mo SaaS With AI Agents — Zero Hand-Written Code
- Want to add quality gates to your AI workflow? Watch: How to add quality gates to your AI automation workflow: A practical guide from output to trustworthy results
Monetization angle
How can you make money from this trend?
WayToClawEarn focuses on verified earn playbooks—not just news. Start from these cases.
n8n + OpenAI affiliate site
Automate content and affiliate monetization
Claude + n8n automation agency
Charge monthly for agent workflow builds