Anthropic Expands Project Glasswing to Global Partners

Reuters and CNBC report that Anthropic is expanding Project Glasswing, adding roughly 150 organizations and bringing total participants to about 200 across more than 15 countries (Reuters; CNBC). Per Anthropic's announcement, selected partners receive gated access to the unreleased frontier model Claude Mythos Preview to find and fix vulnerabilities in critical software, and the company is committing up to $100M in usage credits for Mythos Preview plus $4M in donations to open-source security groups (Anthropic). Anthropic says partners have identified more than 10,000 high- or critical-severity flaws. The newly added partners skew toward power, water, healthcare, communications, and hardware vendors whose code underpins national-scale infrastructure.

Public reporting frames Claude Mythos Preview as a general-purpose frontier model with unusually strong code-analysis and exploit-discovery performance, able to chain together small memory-corruption bugs into high-severity attack paths - described as accelerating what skilled humans can already do rather than inventing a new class of vulnerability (Reuters; CNBC). Anthropic has not released the model publicly, citing misuse risk, and says Mythos-class access could broaden once additional safeguards are ready.

Security researcher Bruce Schneier calls the rollout "very much a PR play," arguing reporters have repeated Anthropic's talking points uncritically and that, per his reading, almost none of the reported vulnerabilities have been patched (Schneier). Schneier also points to the security firm Aisle reportedly replicating Anthropic's findings using older, cheaper public models, which would undercut claims that Mythos is uniquely capable. Anthropic's refusal to release granular data limits independent verification of the 10,000+ figure.

For defenders and infrastructure owners, code-capable frontier models change vulnerability-discovery timelines and widen the window between discovery, coordinated disclosure, and remediation. Politico reports the expansion has drawn regulatory interest, with EU agencies such as ENISA seeking mechanisms to evaluate the model (Politico).

• •Whether affected vendors and open-source projects publish coordinated patches or advisories for Glasswing-identified flaws.
• •Independent red-team or replication reports that can validate or contest the 10,000+ high/critical figure.
• •The partner list and access-gating mechanisms, which Politico and CNBC describe as central to trust-building.
• •Regulatory engagement in the EU and elsewhere over access and safeguards.

The program expansion and the $100M-plus commitment are confirmed by Anthropic and independent outlets, but the headline capability and vulnerability figures remain vendor-reported and contested. The story captures a broader tension: powerful code-capable models offer real defensive value while making transparency, rigorous vetting, and independent validation essential.