Anthropic Launches Project Glasswing To Harden Software Security

Anthropic announced Claude Mythos Preview and Project Glasswing on April 7, 2026, giving vetted access to a coalition of technology and security organizations rather than releasing the model publicly. Core launch partners include Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks, alongside more than 40 additional organizations that build or maintain critical software infrastructure. Anthropic is committing up to $100 million in Claude usage credits to the effort, plus $4 million in direct donations split between the Linux Foundation's Alpha-Omega and OpenSSF programs and the Apache Software Foundation.

Anthropic says Mythos Preview identified thousands of zero-day vulnerabilities across every major operating system and web browser, working autonomously without human steering in most cases. Three disclosed examples: a 27-year-old remote-crash vulnerability in OpenBSD, an operating system with a reputation for being security-hardened; a 16-year-old bug in the video library FFmpeg that automated testing tools had exercised five million times without catching it; and a chained set of Linux kernel vulnerabilities that let an attacker escalate from ordinary user access to full control of a machine. On Anthropic's CyberGym vulnerability-reproduction benchmark, Mythos Preview scored 83.1% versus 66.6% for Claude Opus 4.6, the company's next-best model; on SWE-bench Verified it scored 93.9% versus 80.8%.

The gap between Mythos Preview and Opus 4.6 on coding and cyber benchmarks previews how fast this capability class is moving, with concrete implications: teams should expect model-driven vulnerability discovery to become a normal part of red-team and dependency-audit workflows, and should treat long-unpatched code paths, like FFmpeg's, as newly exposed rather than safely dormant. Because Mythos itself stays gated, the near-term risk is asymmetric: defenders inside Project Glasswing get a head start, while everyone else should assume comparable offensive capability is 6 to 24 months away, per Anthropic's own estimate.

1. March 26, 2026

   A data leak exposed draft documents describing an unreleased Anthropic model under the working names Mythos and Capybara, first reported by Fortune.

2. April 7, 2026

   Anthropic officially launched Claude Mythos Preview and Project Glasswing, giving vetted partners gated access to the model.

3. July 6, 2026

   Anthropic's committed 90-day public report on Project Glasswing's findings and fixes is due.

Anthropic's 90-day public report, due around July 6, 2026, should offer the first concrete evidence of Glasswing's real-world impact, including which vulnerabilities were fixed. Also watch whether Mythos-class capability proliferates to actors outside the partner group faster than the 6-to-24-month window Anthropic has floated, and how partners including Cisco, AWS, Microsoft, and Google operationalize Mythos findings into patches and advisories.