Anthropic says it and upwards of 50 partners involved in Project Glasswing have uncovered an estimated 10,000 critical or high-severity vulnerabilities in their software offerings.

The company launched the cybersecurity initiative, which is built around Claude Mythos Preview, in April, stating that its launch partners would use it as part of their defensive security work.

Anthropic said it created Project Glasswing when capabilities in its new frontier model “revealed a stark fact: AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities.” At the time, it also indicated that it was committing upwards of $100 million in usage credits, as well as an additional $4 million in donations to open source security organizations.

In an update published late last week, Anthropic stated, “for the last few months we have used Mythos Preview to scan more than 1,000 open-source projects, which collectively underpin much of the internet — and much of our own infrastructure.”

During that process, Mythos Preview found 6,202 high or critical severity vulnerabilities in these projects, 1,752 of which have since been assessed by six independent security research firms.

Maintainers facing bug report deluge

Of these, Anthropic stated, 90.6% (1,587) “have proved to be valid true positives, and 62.4% (1,094) were confirmed as either high or critical severity. That means that even if Mythos Preview finds no further vulnerabilities, at our current post-triage true-positive rates, it’s on track to have surfaced nearly 3,900 high or critical severity vulnerabilities in open source code — in addition to those it has found for Project Glasswing’s partners.”

Authors of the report noted that, on top of the regular challenges of maintaining open-source software, “maintainers have been facing a deluge of low-quality, AI-generated bug reports. Indeed, several maintainers have told us they’re currently severely capacity constrained, and some have even asked us to slow down our rate of our disclosures because they need more time to design patches.”

Anthropic estimated that it has disclosed 530 high or critical severity bugs to maintainers so far, and is aiming to disclose another 827. Of those 530 bugs, 75 have been patched, and there have been 65 public advisories. The company said that the relatively low number is due to three factors: first, the 90 day window set out in its coordinated vulnerability disclosure policy has not closed, second, it is probably undercounting because some flaws have been patched without disclosure, and finally, the security ecosystem is already overloaded.

“The relative ease of finding vulnerabilities compared with the difficulty of fixing them amounts to a major challenge for cybersecurity,” the report’s authors noted.

Nonetheless, Glasswing’s success so far has led the company to release Claude Security in beta for its enterprise customers, and it has begun its Cyber Verification Program to allow legitimate security pros to use its models in their work without certain of its safeguards.

Mark Tauschek, distinguished analyst at Info-Tech Research Group, said Anthropic’s decision to keep access to Claude Mythos Preview restricted through Project Glasswing is one of the clearest signals yet that frontier AI capabilities have crossed a real threshold in cybersecurity.

The company, he said, “deserves some credit for the transparency of its system card and the structure of Project Glasswing. But being transparent about the problem is not the same thing as solving it.”

According to Tauschek, “the update validates the practical reality that IT and security leaders now have to deal with the fact that the cost of discovering software vulnerabilities has dropped dramatically. If a single AI model can surface thousands of serious vulnerabilities across foundational software in a matter of weeks, the window between vulnerability discovery and exploitation will keep compressing.”

Organizations still treating patching as a quarterly exercise are operating with materially more risk than they were even a short time ago, he added.

Tauschek said that the fact that some maintainers have asked Anthropic to slow down should not be seen as resistance to better security. “Rather, it points to a capacity problem that has been building for years,” he said. “Many of the open-source projects enterprises rely on are maintained by small teams or volunteers, often people with day jobs.”

A key bottleneck has moved

Meanwhile, he said, the “organizations depending on that code operate at a massive scale. AI can accelerate discovery, but it does not create the human capacity required to validate findings, design safe patches, test them, and get them deployed. This also forces a rethink of defense-in-depth.”

Kellman Meghu, CTO of DeepCove Cybersecurity, added that nothing in the Project Glasswing update is surprising to him. “Our company had figured out almost two years ago that, in the hands of a competent researcher, the ability [of AI] to find vulnerabilities and exploit them were greatly accelerated,” he noted. “I think the change now is that the barrier of entry to drive the prompts in a large language model has dropped significantly. This will only get better, and is our new reality.”

DeepCove, he said, “has had to accelerate its patching and controls assessment, which now includes leveraging large language models to help identify and patch or build compensating controls for our services and our customer infrastructures.”

According to Meghu, “finding bugs is now cheap, but patching them is still slow and human-bound in many cases. Clients have change management processes, regulatory testing windows, and change blackouts that make absorbing this pace genuinely hard.”

What Anthropic’s update really shows, he pointed out, “is that the bottleneck in cybersecurity has moved from finding vulnerabilities to absorbing patches and adapting client defenses fast enough to keep up.”

His take echoes that of Anthropic, which noted, “the bottleneck in fixing bugs like these is the human capacity to triage, report, and design and deploy patches for them.”

The operational pressure of the new patch cadence is “as immediate as the offensive threat,” Meghu said. “We’ve responded by building AI-assisted auditing into our own development pipeline and tightening client patch SLAs on critical dependencies. But this is not an easy process to manage. We do not blindly trust LLMs or agents to operate autonomously, and this has resulted in significant change in operator assisted processes for LLM integration.”

As well, noted David Shipley, CEO of Beauceron Security, “the headline grabber that everyone’s been paying attention to is the 10,000 potential vulnerabilities it found, and then, of those, 6,000 being critical, but when you actually pare the numbers down, you get closer to 1,500 that are actually human verified, legitimate, and so that’s quite a fall off.”

“[Anthropic also stated that] 90% of the 1,752 higher critical rated vulnerabilities that have been humanly reviewed were found to be accurate,” he said. “Cool, but that means it’s still about 15% of the total number that it found.”

According to Shipley, a critical question that has yet to be unanswered is the cost of finding each one of these vulnerabilities. “How many tokens are you burning? I’ve heard it’s in the range of $500 a minute, so I’m really curious to know what the cost is,” he said. “Surely, if they can tell us how ‘we found this many’, [they can answer] how much compute did it cost?”

He added that the only ultimate fix is to “make software makers liable for their software. That is the only way out of this mess, because that is the fundamental misalignment that got us here.”