glasswing-vulnerability-discovery

name: glasswing-vulnerability-discovery description: AI-powered vulnerability discovery methodology from Anthropic's Project Glasswing - using frontier models (Mythos Preview) to find critical security vulnerabilities in open-source and enterprise software. version: 1.0.0 author: Anthropic Research date: 2026-05-22 source: https://www.anthropic.com/research/glasswing-initial-update category: cybersecurity tags: [cybersecurity, vulnerability-discovery, ai-security, frontier-models, mythos] activation_keywords: [glasswing, vulnerability discovery, mythos preview, AI security testing, frontier red team]

Project Glasswing: AI Vulnerability Discovery

Methodology from Anthropic's Project Glasswing (May 2026) using Mythos Preview AI model to discover critical security vulnerabilities at unprecedented scale.

Core Concept

Project Glasswing uses frontier AI models (Mythos Preview) to scan software for vulnerabilities. Within one month, partners found 10,000+ high/critical vulnerabilities - a 10× increase in bug-finding rate.

Results Summary

Partner Examples

• Cloudflare: 2,000 bugs (400 high/critical), false positive rate better than human testers
• Palo Alto Networks: 5× increase in patches
• Microsoft: Continued trending larger patches
• Oracle: Multiple times faster vulnerability fixing

Vulnerability Disclosure Process

Follows industry convention:

• 90 days after discovery
• 45 days after patch becomes available
• Allows end users to update before exploitation risk

Key Vulnerability Types Found

1. Critical Infrastructure: Internet infrastructure software
2. Cryptographic Libraries: wolfSSL exploit construction
3. Enterprise Systems: Cloud service vulnerabilities
4. Open-Source Projects: 1,000+ projects scanned

Implementation Pattern

AI Vulnerability Scanning Workflow

1. Identify critical software targets
2. Run Mythos Preview scan
3. AI estimates severity (low/medium/high/critical)
4. Triage by independent security researchers
5. Validate true positives (90.6% rate achieved)
6. Confirm severity classification
7. Follow 90-day disclosure timeline
8. Patch deployment tracking

Exploit Construction Example

For wolfSSL vulnerability:

• Mythos Preview constructed working exploit
• Demonstrated actual exploitability
• Confirmed severity rating

Security Research Integration

• Six independent security research firms for triage
• Human validation required before disclosure
• Collaborative approach with software maintainers

Limitations and Considerations

1. Disclosure Lag: Cannot detail findings until patches deployed
2. False Positives: 9.4% false positive rate requires human triage
3. Scale Challenge: Limit now is verification/disclosure speed, not discovery
4. Responsible Disclosure: Must balance security vs. end-user protection

Non-Security Applications

Mythos Preview also useful for:

• Fraud detection (prevented $1.5M wire transfer fraud)
• Real-time security monitoring
• Attack pattern recognition

Deployment Considerations

• Patch deployment speed now matters more than discovery speed
• Coordination with security teams essential
• Standard disclosure timelines apply

External Evidence

• External testers report Mythos Preview effectiveness
• ExploitBench and ExploitGym evaluations confirm performance
• Frontier Red Team blog validation

Recommendations

1. For critical infrastructure: Use AI scanning for proactive security
2. For open-source maintainers: Expect increased vulnerability reports
3. For enterprises: Plan for accelerated patch cycles

See Also

• adversarial-testing-framework - AI adversarial testing
• agentic-coding-security - Security for agentic AI
• red-teaming - Red team methodology

Extracted from Anthropic Research: Project Glasswing (May 2026)