Anthropic’s Project Glasswing has fundamentally altered the cybersecurity landscape by demonstrating how unreleased frontier AI models can uncover more than 10,000 high- or critical-severity zero-day vulnerabilities.
Claude Mythos, launched in early April 2026, aims to secure critical software infrastructure before highly capable threat actors can weaponize autonomous AI models.
As part of a collaborative effort with approximately 50 technology partners, the project underscores the incredible defensive potential of AI while highlighting the systemic risks of accelerated vulnerability discovery.
Claude Mythos Preview has showcased offensive cybersecurity capabilities that significantly outpace those of previous models and human capabilities.
Claude Mythos Preview Identifies Thousands of 0-Day
Project partners, including Cloudflare, reported discovering thousands of bugs and noted a false-positive rate superior to that of human testers.
The UK’s AI Security Institute (AISI) observed that Mythos Preview is the first model to fully solve its rigorous corporate network attack simulations, completing an average of 22 out of 32 steps and achieving full end-to-end compromise in 30% of attempts.
Furthermore, the academic ExploitGym benchmark revealed that Mythos successfully exploited 157 of 898 real-world vulnerabilities, significantly outperforming competitors such as GPT-5.5.
Mozilla effectively leveraged the model to find and fix 271 zero-day vulnerabilities in Firefox 150, more than 10 times the number discovered in previous AI iterations.
By scanning over 1,000 critical open-source projects, Mythos Preview identified 23,019 candidate vulnerabilities.
Out of these candidates, external security firms triaged and confirmed 1,726 valid findings, achieving an impressive 90.8% true positive rate. Anthropic disclosed 1,596 of these vulnerabilities directly to software maintainers.
A notable discovery during this phase was CVE-2026-5194, a devastating flaw in the widely used wolfSSL cryptography library.
Carrying a CVSS score of 9.3, this vulnerability allowed attackers to bypass cryptographic digest checks and forge digital certificates, enabling complete identity spoofing.
Despite the high volume of disclosures, only 97 bugs have been successfully patched upstream so far, resulting in 88 public advisories.
The sheer volume of discoveries has created a critical bottleneck where the human capacity to triage, report, and patch software is rapidly overwhelmed by AI-driven vulnerability detection.
Some open-source maintainers have even requested a slowdown in disclosure due to severe capacity constraints, leading to a dangerous interim period in which known flaws remain unpatched.
Because unpatched zero-days represent a lagging indicator of a frontier model’s true capabilities, the industry must fundamentally rethink how it manages and deploys security patches at scale.
To address these defense gaps, according to Anthropic, organizations must adopt proactive measures immediately.
Anthropic recently launched Claude Security in public beta for Enterprise customers, enabling organizations to scan their proprietary codebases and rapidly generate patches autonomously.
Additionally, the Cyber Verification Program now permits vetted security professionals to utilize Anthropic’s models without standard cyber safeguards for legitimate penetration testing and red-teaming operations.
Network defenders must urgently adapt to this accelerated threat landscape by shortening patch cycles, enforcing multi-factor authentication, and leveraging AI tools to automate code remediation before malicious actors inevitably gain access to similar autonomous exploitation capabilities.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
