Anthropic launches Project Glasswing for cyber defence
Anthropic has launched Project Glasswing with a group of technology and security partners, giving selected organisations access to Claude Mythos Preview for defensive cybersecurity work.
The launch group includes Amazon, Apple, Broadcom, Cisco, CrowdStrike, the Linux Foundation, Microsoft and Palo Alto Networks. Around 40 additional organisations that build or maintain critical software infrastructure will also be able to use the model to scan their own systems and open-source software.
Anthropic will provide up to USD $100 million in usage credits through the project and make USD $4 million in direct donations to open-source security organisations. Claude Mythos Preview is not expected to become generally available; access will remain limited to project partners and vetted organisations.
Anthropic described Mythos Preview as a general-purpose unreleased model whose cybersecurity performance comes from coding and reasoning rather than training tailored specifically to cyber tasks. In recent weeks, it said, the model identified thousands of zero-day vulnerabilities, including bugs that had gone undetected for years.
Examples included a 27-year-old bug in OpenBSD and a 16-year-old vulnerability in widely used video software. Anthropic said the latter was buried in a line of code that automated testing tools had executed five million times without detecting the flaw.
Industry access
The project reflects a broader push by major technology companies and security suppliers to test whether advanced AI models can help defenders find software weaknesses before attackers do. It also brings open-source maintainers into the programme through the Linux Foundation, highlighting how heavily critical infrastructure depends on widely used shared code.
Microsoft said its testing showed gains on a security benchmark. "As we enter a phase where cybersecurity is no longer bound by purely human capacity, the opportunity to use AI responsibly to improve security and reduce risk at scale is unprecedented. Joining Project Glasswing, with access to Claude Mythos Preview, allows us to identify and mitigate risk early and augment our security and development solutions so we can better protect customers and Microsoft. When tested against CTI-REALM, our open-source security benchmark, Claude Mythos Preview showed substantial improvements compared to previous models. We look forward to partnering with Anthropic and the broader industry to improve security outcomes for all," said Igor Tsyganskiy, Global CISO, EVP Security and Microsoft Research, Microsoft.
Cisco cast the initiative as a response to a sharp shift in the threat landscape. "AI capabilities have crossed a threshold that fundamentally changes the urgency required to protect critical infrastructure from cyber threats, and there is no going back. Our foundational work with these models has shown we can identify and fix security vulnerabilities across hardware and software at a pace and scale previously impossible. That is a profound shift, and a clear signal that the old ways of hardening systems are no longer sufficient. Providers of technology must aggressively adopt new approaches now, and customers need to be ready to deploy. That is why Cisco joined Project Glasswing - this work is too important and too urgent to do alone," said Anthony Grieco, Senior Vice President & Chief Security & Trust Officer, Cisco.
CrowdStrike also pointed to shrinking response times between discovery and exploitation. "The window between a vulnerability being discovered and being exploited by an adversary has collapsed - what once took months now happens in minutes with AI. Claude Mythos Preview demonstrates what is now possible for defenders at scale, and adversaries will inevitably look to exploit the same capabilities. That is not a reason to slow down; it's a reason to move together, faster. If you want to deploy AI, you need security. That is why CrowdStrike is part of this effort from day one," said Elia Zaitsev, Chief Technology Officer, CrowdStrike.
Open source focus
The Linux Foundation highlighted the implications for software maintained outside large corporate security teams. "In the past, security expertise has been a luxury reserved for organizations with large security teams. Open source maintainers-whose software underpins much of the world's critical infrastructure-have historically been left to figure out security on their own. Open source software constitutes the vast majority of code in modern systems, including the very systems AI agents use to write new software. By giving the maintainers of these critical open source codebases access to a new generation of AI models that can proactively identify and fix vulnerabilities at scale, Project Glasswing offers a credible path to changing that equation. This is how AI-augmented security can become a trusted sidekick for every maintainer, not just those who can afford expensive security teams," said Jim Zemlin, Chief Executive Officer, Linux Foundation.
Palo Alto Networks said early work with the model had uncovered vulnerabilities that older models missed. "Over the past few weeks, we've had access to the Claude Mythos Preview model, using it to identify complex vulnerabilities that prior-generation models missed entirely. This is not only a game changer for finding previously hidden vulnerabilities, but it also signals a dangerous shift where attackers can soon find even more zero-day vulnerabilities and develop exploits faster than ever before. It's clear that these models need to be in the hands of open source owners and defenders everywhere to find and fix these vulnerabilities before attackers get access. Perhaps even more important: everyone needs to prepare for AI-assisted attackers. There will be more attacks, faster attacks, and more sophisticated attacks. Now is the time to modernize cybersecurity stacks everywhere. We commend Anthropic for partnering with the industry to ensure these powerful capabilities prioritize defense first," said Lee Klarich, Chief Product & Technology Officer, Palo Alto Networks.
Amazon Web Services said it had applied the model to internal security operations and critical codebases. "At AWS, we build defenses before threats emerge, from our custom silicon up through the technology stack. Security isn't a phase for us; it's continuous and embedded in everything we do. Our teams analyze over 400 trillion network flows every day for threats, and AI is central to our ability to defend at scale. We've been testing Claude Mythos Preview in our own security operations, applying it to critical codebases, where it's already helping us strengthen our code. We're bringing deep security expertise to our partnership with Anthropic and are helping to harden Claude Mythos Preview so even more organizations can advance their most ambitious work with security that sets the standard," said Amy Herzog, Vice President and CISO at Amazon Web Services.
Anthropic said it has also been discussing the model's offensive and defensive cyber attributes with US government officials, amid growing concern over how quickly advanced AI systems could reshape both software defence and software exploitation.