Anthropic Expands Project Glasswing to 150 Organizations

According to Anthropic's June 2 blog post, the company is expanding Project Glasswing and will extend access to its Claude Mythos Preview model to approximately 150 new organizations in more than 15 countries. Anthropic's announcement follows an initial cohort of about 50 partners introduced in April (Anthropic blog). The new participants include organizations in power, water, healthcare, communications, and hardware, and many are vendors or nonprofits that maintain codebases relied upon by other organizations and governments (Anthropic blog).

TechCrunch and Politico report that named organizations given access or cited in coverage include NATO, the EU cybersecurity agency ENISA, and private firms such as Okta, Samsung, SK Hynix, and SK Telecom (TechCrunch; Politico). CNBC and Anthropic's blog note that partners must meet security requirements before receiving access (CNBC; Anthropic blog). SiliconANGLE and other outlets report that Project Glasswing participants have already found thousands of vulnerabilities during early testing; Anthropic previously reported more than 10,000 high- or critical-severity flaws and other outlets cited larger aggregate totals found by participants (Anthropic blog; SiliconANGLE).

Public coverage highlights that Claude Mythos Preview is trained to identify not only single vulnerabilities but also to chain exploits, a capability that differentiates it from many general-purpose large language models, according to reporting in SiliconANGLE and TechCrunch. Industry reporting frames the model's capabilities as both an advanced defensive tool and a potential misuse risk because the same reasoning that finds complex exploit chains can be repurposed by attackers. Observed patterns in similar deployments show security-focused models typically require layered access controls, continuous auditing, and tightly scoped test environments to reduce operational risk.

Reporting by TechCrunch, Politico, and CNBC places Anthropic's expansion in a broader industry moment where frontier models with cyber capabilities have prompted coordinated discussion among firms, regulators, and governments. TechCrunch and CNBC note that Anthropic's announcement comes shortly after the company confidentially submitted a draft S-1 to the SEC, which has increased public scrutiny of how advanced models are released and governed (TechCrunch; CNBC). Public-sector actors such as ENISA gaining access reflects growing interest from regulators in hands-on evaluation rather than purely advisory roles (Politico).

For practitioners and security teams, monitoring who is admitted to Project Glasswing and the technical guardrails required for access will be important indicators of operational norms. Industry observers will also track whether other labs' cyber-focused models appear and how their access policies compare; TechCrunch reported that rival labs have released or are testing analogous models. Finally, look for published post-engagement metrics from participants (for example, numbers of validated high-severity findings and patch adoption) that could help quantify benefits and residual risks.

SiliconANGLE quoted Justin Beals, founder and CEO of Strike Graph Inc., saying, "Controlled rollout of frontier AI is the right instinct. But opacity is not a security strategy," to illustrate concerns among some security practitioners about selective access without verifiable transparency (SiliconANGLE).

Anthropic's blog post and press coverage describe the expansion and the types of organizations being added; none of the sources provide a full roster of partners or operational playbooks for access controls. Anthropic's public text states partners must meet security requirements before gaining access but does not publish the full validation criteria in the announcement (Anthropic blog).