Project Glasswing: initial update
Glasswing partners using Mythos Preview found over 10,000 high or critical vulnerabilities; the bottleneck is now verifying, disclosing and patching them.
Six weeks in, about 50 partners reported 10,000+ high or critical flaws. Of 1,752 assessed by independent firms, 90.6% were true positives and 62.4% high or critical. Only 75 of 530 disclosed high or critical open-source bugs had been patched, so maintainers asked Anthropic to slow disclosures.
- Date
- Friday, 22 May 2026
- Lab
- Anthropic
- Kind
- paper
- Access
- paper only
Figures
| Measure | Value | Measured by |
|---|---|---|
| High or critical vulnerabilities found by partners | more than 10,000 about 50 Glasswing partners with Mythos Preview | company |
| True-positive rate on 1,752 assessed findings | 90.6% 62.4% confirmed high or critical; assessed by six independent firms or Anthropic | company |
| Open-source bugs patched | 75 of 530 disclosed average two weeks to patch a high or critical bug | company |
| Firefox 150 vulnerabilities found by Mozilla with Mythos Preview | 271 over 10x the count for Firefox 148 with Opus 4.6 | third-party |
Figures are Anthropic's and partners' own; vulnerabilities are mostly undisclosed under the 90-day convention, so independent verification is limited. Cloudflare reported 2,000 bugs (400 high or critical) with a false-positive rate it rates better than human testers.
Sources
This record was checked against its sources on 6 October 2026. How we check