Project Glasswing expands AI security

TL;DR: Project Glasswing moved AI security from lab demo to live infrastructure work: Anthropic reported 10,000+ high or critical flaws in early partner scans, then expanded to about 200 partners across 15+ countries. The signal is clear. AI can now help security teams find real bugs, but patching still needs disciplined engineering.

Project Glasswing matters because, in its first weeks, Anthropic and roughly 50 partners found more than 10,000 high or critical severity flaws in essential software. Big number. Two weeks later, Anthropic said the program added about 150 organizations, reaching roughly 200 partners across 15+ countries.

That shift changes the security conversation. Not someday, either. When an AI model can inspect real repositories, explain exploit paths, and hand maintainers issues that independent firms validate at high rates, leaders can’t treat AI security as a side experiment anymore.

Can this replace engineers? No. But it can change where they spend attention, especially in old codebases where the backlog is deep, the dependency graph is messy, and routine scanning already produces more noise than most teams can triage.

What is Project Glasswing and why does it matter?

Project Glasswing is Anthropic’s large-scale effort to apply Claude Mythos Preview to security testing across important software, infrastructure, and partner codebases. The model reviews code, identifies vulnerabilities, explains exploitability, and produces reports that humans can verify. The point isn’t magic. It’s faster, deeper triage.

According to Anthropic, Project Glasswing scanned 1,000+ open-source projects and identified 23,019 issues, including 6,202 high or critical severity vulnerabilities, in May 2026 reporting shared through Help Net Security. That volume makes Project Glasswing one of the clearest public examples of AI-assisted vulnerability discovery at operational scale.

Here’s why I think it matters. Most companies don’t lack scanners. They lack time, clear prioritization, and people who can connect a code flaw to business risk. After 50+ projects, we’ve learned that AI systems help most when they reduce analysis time without hiding uncertainty. That’s the useful part here.

The catch is accuracy. Even a good model can misread context, miss compensating controls, or overstate exploitability, so engineering judgment still decides what gets patched first.

How did Project Glasswing expand to 200 partners?

Anthropic first worked with about 50 partners, then expanded Project Glasswing by roughly 150 more organizations two weeks later. The new group covered power, water, healthcare, communications, hardware, vendors, nonprofits, and government-adjacent infrastructure. That spread matters because software risk is no longer limited to tech companies.

According to Anthropic on June 2, 2026, the expansion brought Project Glasswing to about 200 partners across more than 15 countries, including organizations tied to sectors where a serious compromise could affect more than 100 million people. That’s not a normal beta program. It’s a stress test against public-interest software.

And it raises a hard question. Who gets access to this kind of defense first? Large vendors and infrastructure partners may be easier to coordinate, but small maintainers often own packages that sit under thousands of production systems.

When we implemented a RAG chatbot for a fintech client, it reduced support tickets by 40% in 3 months, but only after we mapped ownership, escalation paths, and audit logs. AI impact depends on process. Security is the same.

What do the Project Glasswing numbers tell security leaders?

The Project Glasswing numbers point to a security market with more vulnerability volume, more AI-assisted discovery, and more pressure on patching teams. NVD published 49,972 CVEs in 2025, based on direct aggregation of NVD API results across 120-day windows. That’s already a heavy load before private findings enter the queue.

According to Anthropic, six independent security firms assessed 1,752 high or critical Project Glasswing findings, and more than 90% were validated as true positives. That validation rate is the statistic I’d watch. Raw findings can impress a board, but true positives decide whether engineers keep trusting the tool.

The broader market confirms the pressure. According to Gartner, worldwide information security end-user spending was projected to reach $244 billion in 2026, with 11.6% constant-currency growth. According to IBM’s 2026 Cost of a Data Breach Report, the global average breach cost reached $4.99 million, up 12% year over year.

That said, spending more doesn’t automatically fix vulnerability queues. Better prioritization does.

Project Glasswing benchmarks and related evidence

Security teams should compare Project Glasswing against the surrounding evidence base, not treat one vendor announcement as proof that AI has solved vulnerability management. The strongest signal is cross-checking: public scans, independent validation, and real codebase outcomes from companies like Mozilla and Cloudflare.

According to Mozilla, Firefox 150 shipped fixes for 271 vulnerabilities found during its Claude Mythos Preview evaluation in April 2026. According to Cloudflare, its internal testing found about 2,000 bugs, including around 400 high or critical issues, with output described as higher quality than typical scanner findings.

Amy Herzog, VP and CISO at AWS, states: "Security isn't a phase." That line fits this moment. AI discovery creates value only when tied to patch review, release practice, and production risk management.

Five practical lessons from Project Glasswing

Project Glasswing shows that AI security works best as an engineering system, not a standalone scanner with a nicer report. Teams need intake rules, severity review, ownership, test coverage, and patch tracking. Otherwise, even strong findings pile up into another queue nobody trusts.

According to Black Duck’s 2025 OSSRA, 86% of risk-assessed applications contained vulnerable open-source components, and 81% had high or critical risk vulnerabilities. That tells us the issue isn’t only undiscovered bugs. It’s also dependency age, maintainer capacity, and weak remediation habits across real applications.

1. Treat AI findings as leads, not verdicts

A good AI report should include affected code, exploit reasoning, severity assumptions, and a reproducible path. Still, humans must verify business context. Some findings are real but low priority because an internal control blocks exposure. Others look minor until they touch authentication, payments, or customer data.

2. Put ownership before automation

Before adding AI security review, decide who receives findings, who accepts risk, and who can merge patches. Sounds boring. It’s not. Our team of 10+ specialists has seen AI pilots stall when outputs had no owner, even when the technical quality was good.

3. Measure patch time, not finding count

Anthropic said a high or critical severity bug found by Mythos Preview takes two weeks on average to patch. Finding count is useful, but patch time is the executive metric. If your model finds 400 severe issues and nothing ships, risk hasn’t changed.

4. Connect AI review to CI and release gates

AI review belongs near pull requests, dependency updates, and release candidates. A simple starting pattern is scheduled repository review plus human triage. Then add CI checks for the most repeatable classes, such as unsafe deserialization, injection paths, or missing authorization checks.

from dataclasses import dataclass
from enum import Enum

class Severity(str, Enum):
    critical = "critical"
    high = "high"
    medium = "medium"
    low = "low"

@dataclass
class Finding:
    repo: str
    severity: Severity
    confidence: float
    has_repro: bool
    internet_exposed: bool

def should_escalate(finding: Finding) -> bool:
    severe = finding.severity in {Severity.critical, Severity.high}
    credible = finding.confidence >= 0.80 and finding.has_repro
    exposed = finding.internet_exposed

    return severe and credible and exposed

finding = Finding(
    repo="payments-api",
    severity=Severity.critical,
    confidence=0.91,
    has_repro=True,
    internet_exposed=True,
)

print("page security lead" if should_escalate(finding) else "queue for triage")

5. Budget for false negatives too

The honest limitation: AI security tools don’t see everything. They can miss runtime behavior, production configuration, chained identity flaws, and business logic abuse. I recommend keeping penetration testing, threat modeling, SAST, DAST, dependency scanning, and incident drills in place.

Can AI models change vulnerability management?

Yes, but only if teams redesign vulnerability management around faster discovery. AI models can read more code than a human team, draft exploit reasoning, and sort likely severe issues, yet the hard parts remain: validating risk, writing tests, deploying patches, and communicating impact.

According to OpenAI, introducing Aardvark, "Software vulnerabilities are a systemic risk." That framing is useful because Project Glasswing isn’t only about one model or one vendor. It reflects a wider shift from periodic scanning to continuous AI-assisted code review across software supply chains.

CrowdStrike states: "Frontier models raise the ceiling for both offense and defense." I agree with the defense side, with a caveat. Attackers also get better tools. A 2024 AI cyber benchmark found OpenAI o1-preview reached a 64.71% success rate on an automated exploitation benchmark using the DARPA AIxCC framework and Nginx challenge project.

So the gap won’t close by waiting. Teams need detection, remediation, and secure development practice to improve together.

How should companies start with Project Glasswing-style security?

Companies should start small: pick one important repository, define a triage policy, run AI-assisted review, validate findings manually, and track patch outcomes for 30 to 60 days. Don’t start with every repo. That usually creates noise, meetings, and defensive reactions from engineering teams.

According to Anthropic, it had disclosed 530 high or critical severity bugs to maintainers by May 22, 2026, with 827 more confirmed vulnerabilities still pending disclosure. That backlog is a warning. Discovery can speed up faster than disclosure, review, and patching.

When we implemented a document processing pipeline for a legal client, it automated 80% of contract review and saved 120 hours per month, but the rollout worked because we built approval checkpoints into the workflow. Security AI needs the same discipline. Our team of 10+ specialists has used LangChain, LangGraph, CrewAI, and Agno in production ML systems, and the pattern is consistent: start with a narrow workflow, measure trust, then expand.

For leaders planning AI-assisted security review, Yaitec can help assess repositories, define triage rules, and build production workflows around model output. If you want a practical review of where this fits in your stack, contact us.

Conclusion

Project Glasswing is a signal that AI-assisted security has crossed into serious production territory. Anthropic’s early reports point to 10,000+ high or critical flaws, about 200 partners across 15+ countries, and validated findings that made it into real products like Firefox 150. That’s meaningful.

According to IBM’s 2026 Cost of a Data Breach Report, the global average breach cost reached $4.99 million, while AI-driven attacks increased 56%. Those numbers explain why waiting is risky. But the answer isn’t buying a model and flooding Jira. It’s building a disciplined vulnerability workflow where AI helps find, explain, and rank issues, while engineers verify and ship fixes.

After 50+ projects, we’ve learned that successful AI adoption is rarely about the flashiest demo. It’s about trust, ownership, and feedback loops. Project Glasswing gives security teams a clear prompt: use AI to see more, then build the operating muscle to fix what it finds.

Sources

• Anthropic — retrieved 2026-09-01