Project Glasswing, explained: what it means when a model finds 10,000 bugs in six weeks

Anthropic published an update on Project Glasswing on 22 May. The headline number is striking: Claude Mythos Preview, the unreleased frontier model at the centre of the programme, surfaced more than 10,000 high- or critical-severity vulnerabilities across partner codebases in roughly six weeks. Mozilla shipped 271 fixes in Firefox 150 traceable to the work. Palo Alto Networks' resulting patch release was five times its normal size. The UK AI Safety Institute reported that Mythos is the first model to complete both of its cyber-range simulations end-to-end.

I want to walk through what's actually happening here, because the press summary ("AI finds lots of bugs") skips the part that matters. The interesting question isn't whether a model can find vulnerabilities. Models have been finding vulnerabilities for years. The interesting question is what changed, and where the bottleneck went.

What "finding a vulnerability" actually means

When you read "the model found 10,000 vulnerabilities," it's tempting to picture Claude reading source code top to bottom, going "ah, line 47 is bad," and moving on. That isn't the shape of the work.

A real vulnerability finding is a chain, not a spot. To call something a critical bug, you need to establish three things:

The flawed code path exists. Somewhere in the codebase, there's a function that does something unsafe — trusts input it shouldn't, frees memory it still uses, writes past a buffer, takes a lock in the wrong order. This is the part that looks like "reading code."

The flawed code is reachable. Most unsafe-looking code is actually fine because no attacker-controlled input ever gets to it. To matter, the bug needs a path from somewhere an attacker can touch (a network port, a file format, a URL parameter) all the way down into the broken function, with the right values surviving every check along the way. This is called reachability, and it's where most vulnerability scanners drown in false positives.

The reachable path is exploitable. Reachable isn't enough. You need to show that the bug can be turned into something — code execution, privilege escalation, data exfiltration. A use-after-free that crashes the program is a bug. A use-after-free where an attacker can control the memory that gets reused is a vulnerability.

Older tools handle each step separately and poorly. Static analysers are good at step one and bad at step two. Fuzzers are good at finding crashes but bad at explaining what they mean. Human researchers can do all three but slowly, one bug at a time. The step-change Mythos seems to represent is doing all three in one pass, at scale, with enough judgement to throw away the noise.

That's why AISI's "end-to-end" attestation matters. A cyber range is a simulated network, virtual machines, services, traffic, the works, built to let red teams practise. AISI's challenges don't just ask "is there a bug here?" They ask "can you get from outside the network to root on the database server?" Solving that end-to-end means the model didn't just spot a flaw; it stitched flaws together into a working chain. That's a qualitatively different bar.

Why the previous generation couldn't do this

Claude Opus 4.6 found roughly a tenth of what Mythos found on the same Firefox codebase. That ratio is the interesting part of the update. The codebase didn't change. The scanning approach didn't fundamentally change. What changed is the model's ability to reason across long, branching code paths without losing the thread.

Vulnerability discovery is unusually punishing for language models. You need to track which variables are tainted by attacker input, across function boundaries, through indirection, conditional on runtime state, often across files. Lose the thread for one hop and you either miss the bug or hallucinate one that isn't there. Earlier models could do this for short paths and gave up on long ones. Mythos appears to hold the chain together far longer, which is why the count goes up by 10x rather than 10%.

I haven't seen Anthropic publish the architectural details that produced this — and they probably won't, given the offensive-capability concerns. So I'm describing the behaviour the numbers imply, not the mechanism inside the model.

Where the bottleneck went

Here is the part of the story that doesn't make the headline.

If a model finds 10,000 vulnerabilities, somebody has to do something with them. Each one needs a human to confirm it's real, assess how exploitable it actually is, write a patch, test the patch doesn't break anything, and ship it through a release process. Maintainer teams have finite capacity. A typical Firefox sprint might safely ship dozens of security fixes. The fact that Mozilla shipped 271 in Firefox 150 is itself a heroic effort.

So when discovery jumps 10x, patch velocity doesn't jump with it. The constraint moves. It used to sit at "can we find the bugs?" It now sits at "can we review and ship the fixes?" This is why Glasswing is structured as a human-in-the-loop programme: every flagged vulnerability is reviewed by a human before any patch goes near production. It has to be. The cost of a bad auto-patch in Firefox or a cloud control plane is catastrophic. A false positive wastes a reviewer's afternoon. A false fix could break the browser for hundreds of millions of users.

This is also the answer to a question that should be nagging at you: if the model is this good, why isn't it just patching everything itself? The technology may be ready for that. The institutional trust isn't, and shouldn't be, yet.

The asymmetry, and why Anthropic isn't shipping Mythos broadly

Mythos Preview isn't on the API. You can't get it through Claude.ai. Access is gated on being a Glasswing partner — roughly 50 organisations, mostly large vendors and infrastructure providers. Anthropic's own framing is that they're trying to "get ahead" of AI-enabled offensive capability by deploying the same capability defensively first.

The logic here is worth thinking through carefully, because it cuts against the usual "release everything, let the market figure it out" instinct.

Offence and defence in cybersecurity aren't symmetric. A defender needs the capability deployed systematically across every system they care about. An attacker needs it once, against one target, to win. So if Mythos-class capability becomes available to both sides at the same time, defenders are still racing to find their bugs while attackers only need to find one. The defensive value of the technology depends on getting a head start, and the size of the head start determines how much of the bug debt gets paid down before adversaries catch up.

How long is that head start? Probably weeks to months, not years. Frontier capability propagates: through competitor models reaching similar levels, through leaks, through jailbreaks of the model itself. Glasswing's restricted release is an attempt to use that window aggressively. Whether it works depends on whether the partner cohort can actually clear the patch queue before the capability becomes broadly available.

Where the metaphor breaks

I've been describing Mythos as if it's reading code the way a senior security researcher reads code. That's the metaphor that gets you to understanding. It also breaks in two important places.

First, the model doesn't know whether its findings are real in the way a researcher knows. It produces structured outputs that have to be checked. The 10,000 number is "things the model flagged with high confidence," not "10,000 confirmed CVEs." Independent classification of those findings isn't public.

Second, a cyber-range win isn't a real-world win. Ranges are clean: known topologies, no defenders pushing back, no noisy production traffic, no weird legacy systems behaving in undocumented ways. Generalising from range performance to "Mythos can compromise real networks" is a leap the data doesn't yet support.

What to watch

Three things, in order of how soon they'll tell you something:

The patch-shipped number, not the bugs-found number. If six months from now Glasswing partners have shipped fixes at a rate that matches or approaches discovery, the programme is working as advertised. If discovery keeps climbing and shipped fixes plateau, the bottleneck has fully moved and the headline numbers are misleading.

Whether the cohort widens. Fifty partners covers a slice of critical infrastructure. It doesn't cover the long tail of open-source libraries that underpin almost everything. The decision about when and how to extend access, or to release a less capable variant more broadly, is the real policy question Glasswing is teeing up.

Whether anyone else gets to Mythos-level capability, and how Anthropic responds. The defensive lead only exists while it exists. Watch the model evals from other labs, and watch what Anthropic does to the restricted-access policy when the gap closes.

Further reading

• Anthropic, Project Glasswing: An initial update: https://www.anthropic.com/research/glasswing-initial-update
• Anthropic, Project Glasswing: Securing critical software for the AI era: https://www.anthropic.com/glasswing
• Cade Metz, Is Anthropic's Claude Mythos Really a Cybersecurity Risk?, The New York Times, 12 May 2026: https://www.nytimes.com/2026/05/12/technology/anthropic-claude-mythos.html

¶