On April 7, 2026, Anthropic launched Project Glasswing, a restricted-access defensive initiative built around the unreleased Claude Mythos Preview model. Backed by a 12-member consortium—including AWS, Microsoft, Apple, and Cisco—and capitalized with $100 million in compute credits, the stated goal was to automate infrastructure auditing before hostile state actors could weaponize frontier cognition.

The telemetry from the first month of operation is unvarnished. Project Glasswing partners identified over 10,000 high- or critical-severity vulnerabilities across systemically critical enterprise software, alongside an estimated 6,202 severe flaws across open-source repositories. When six independent security research firms evaluated a sample of 1,752 automated findings, they confirmed a 90.6% validity rate.

The industry broadly accepted that large language models would eventually graduate from writing unit tests to discovering surface-level cross-site scripting errors. We are told that AI security tools are simply higher-velocity fuzzers, generating massive volumes of low-signal noise that still require human intelligence to filter. They are reading the wrong map. When a neural network autonomously synthesizes multi-stage remote execution payloads for legacy kernels, the defensive grace period does not compress. It evaporates.

The most destructive consequence of Project Glasswing is not the volume of vulnerabilities discovered, but the collapse of the unit economics required to find them.

Historically, acquiring a remote Denial-of-Service or arbitrary execution primitive in a foundational protocol required tapping the black market, where sophisticated zero-days command bounties ranging from $25,000 to over $250,000. Claude Mythos Preview operates at standard frontier token costs: $10.00 per million input tokens and $50.00 per million output tokens.

During its initial sweep, the model’s Anthropic Frontier Red Team handlers fed it the raw C source code of OpenBSD's TCP stack. It discovered an unauthenticated remote Denial-of-Service flaw in the selective acknowledgment (SACK) packet-handling logic within sys/netinet/tcp_input.c. The vulnerability allowed an attacker to panic and crash any exposed machine using malformed network packets. Human eyes and automated fuzzing suites had missed the logic error for 27 years.

The model run that pulled that 27-year ghost out of the source tree cost less than fifty dollars.

This is not an isolated anomaly. Mythos identified a 16-year-old memory corruption flaw in the core H.264 parsing logic of FFmpeg (libavcodec/h264_slice.c). Because FFmpeg is the preëminent multimedia framework embedded in virtually every tier of commercial browsers and streaming infrastructure, discovering an unauthenticated integer underflow here grants catastrophic leverage. Automated fuzzing suites had exercised this specific code path more than five million times without triggering the crash.

The generational leap in capability is undeniable. When tasked with writing exploits against Firefox 147, the previous flagship model, Claude Opus 4.6, produced just two that worked. Under identical conditions, Claude Mythos produced 181. Across Anthropic's broader evaluations, it turned 72.4 percent of its findings into working exploits.

Corporate marketing departments and breathless media coverage suggest that frontier models generate working zero-day exploits "in seconds." This is technical fiction. While Mythos can identify candidate vulnerability triggers during sub-minute inference passes, end-to-end autonomous exploit synthesis requires rigorous, iterative debugging.

The true mechanical terror of Project Glasswing is found in the automated harnesses built around the model. Cloudflare CSO Grant Bourzikas documented their internal deployment, running Mythos Preview over more than 50 of the company's own repositories. To keep the model from hallucinating execution paths that do not exist, Cloudflare engineers built a multi-stage harness around it.

The architecture is adversarial by design. Up to fifty agents run in parallel, and every exploit chain one agent claims is handed to a second agent whose only job is to disprove it; findings that survive the challenge reach a human. The model writes code to trigger the bug, compiles and runs it in a sandbox, and when the result misbehaves, reads the error, revises its hypothesis, and tries again.

Through this loop the model achieves autonomous primitive chaining. It pivots from a basic Use-After-Free bug to arbitrary read and write. It aligns the ROP gadget layout. It hijacks execution control flow.

The same discipline produced a working remote kernel exploit for FreeBSD (CVE-2026-4747), a stack overflow in the RPCSEC_GSS authentication code that sits in front of its Network File System service, reported by Anthropic's Nicholas Carlini using Claude. Claude wrote the exploit in roughly eight hours of wall-clock time. The shellcode was too large for a single packet, so it first made kernel memory executable, then delivered the payload thirty-two bytes at a time across fourteen packets.

For two decades, the cybersecurity industry relied on the 90-day Coordinated Vulnerability Disclosure (CVD) standard. The protocol dictates that a researcher privately notifies a vendor of a vulnerability and waits 90 days before publishing the exploit, granting the maintainer time to develop, test, and distribute a patch.

The Project Glasswing consortium ostensibly still binds its disclosures to standard 90-day CVD timelines. Legally and procedurally, the policy remains on the books. Mechanically, the policy is dead.

The 90-day window was calibrated for a world where vulnerabilities were discovered sequentially by human researchers. It fundamentally breaks when a machine-learning cluster drops three dozen fully weaponized vulnerability reports into a private GitHub security inbox on a Tuesday morning.

By late May 2026, Project Glasswing had disclosed 530 high- and critical-severity zero-day vulnerabilities directly to open-source project maintainers. Only 75 of those vulnerabilities had been patched when Anthropic published its first results—a remediation rate of 14.2%. The bottleneck is not silicon; it is human biology. Volunteer maintainers lack the caloric bandwidth to triage machine-generated stack traces, reverse-engineer the model’s offset calculations, write surgical C rewrites, develop regression tests, and ship updates before the 90-day deadline elapses.

The system has reached operational deadlock. Maintainers across major open-source foundations have been forced to formally petition Anthropic to deliberately throttle its disclosure submissions. We are witnessing the unprecedented scenario where the software supply chain is begging a vendor to stop finding catastrophic flaws in their infrastructure, because knowing about the fire is worse than remaining ignorant if you lack the water to put it out.

When you deconstruct the 90-day window, you realize it was never a security mechanism. It was a subsidy. It subsidized the tech industry's reliance on unpaid open-source labor by artificially capping the speed at which that labor was stress-tested.

If Project Glasswing remained confined to web frameworks and embedded TLS libraries, the crisis would merely be one of corporate compliance. But computational intelligence does not respect logical boundaries.

Mythos has already demonstrated an uncompromising proficiency with embedded systems. It detected and weaponized a critical certificate validation flaw in wolfSSL (CVE-2026-5194), a widely deployed TLS library. By bypassing X.509 signature verification, the model generated an exploit that permitted unauthenticated remote attackers to forge digital certificates and hijack encrypted sessions across millions of IoT devices.

In early June 2026, Anthropic expanded Project Glasswing to approximately 150 additional organizations across more than fifteen countries. The new members came from sectors the program had never touched: power, water, health care, telecommunications—the operators of grids, treatment plants, and SCADA infrastructure.

The UK AI Security Institute (AISI) recently confirmed that Claude Mythos Preview became the first foundation model to complete standardized multi-host enterprise cyber ranges end-to-end. It solved compound lateral movement and privilege escalation scenarios natively, using standard command-line network tools without requiring specialized orchestration scripts.

The transition from auditing a web server to auditing a municipal water facility's logic controller is simply a matter of swapping the target repository. The model does not care if the arbitrary execution primitive it discovers controls a database read replica or a physical centrifuge valve. The math is identical.

The enterprise technology sector is currently trapped in a multi-billion-dollar race to coördinate machine-speed vulnerability discovery, masking the reality that they have entirely forgotten to reëngineer the remediation supply chain. Anthropic’s $4 million cash donation to open-source remediation infrastructure ($2.5 million to Alpha-Omega/OpenSSF and $1.5 million to the Apache Software Foundation) is a fractional, administrative gesture applied to a structural hemorrhage.

The architectural dilemma is irreconcilable. If a vendor deploys a Mythos-class model against their infrastructure, they will instantly generate a backlog of hundreds of validated, critical zero-days that their engineering teams cannot physically patch within a fiscal quarter. The moment those vulnerabilities are documented in internal ticketing systems, the organization assumes massive legal liability for operating known-compromised infrastructure.

Conversely, if the vendor refuses to scan their own systems, they surrender the asymmetric advantage to hostile state actors operating equivalent models outside the restrictions of the Glasswing consortium.

We have successfully automated the destruction of the software perimeter, substituting human ingenuity for probabilistic compute. But the physical consequences of that code—the hijacked hospital records, the forged TLS certificates, the panicked TCP stacks—still fall entirely on human shoulders. The architecture has shifted, and the final bill is routing to the biological layer. In modern infrastructure warfare, the machine fires the weapon, but society absorbs the impact.