CIRA VP Jon Ferguson Links Mythos to Need for Sovereign AI

BetaKit published a Q&A with Jon Ferguson, vice-president of cyber and DNS at the Canadian Internet Registration Authority, about Anthropic's preview program Glasswing and the model Mythos. BetaKit reports that Anthropic presented Mythos as capable of finding and exploiting vulnerabilities across major operating systems and browsers. BetaKit cites Mozilla CTO Bobby Holley as reporting 271 vulnerabilities found in early-access testing, compared with Opus 4.6's lower count, and notes that Glasswing access has been given to US firms including Amazon Web Services, Apple, Cisco, and Microsoft. BetaKit also reports that the White House blocked Anthropic's effort to expand Glasswing access to 70 more companies, and that BetaKit did not receive a response from Anthropic by press time.

Models used to surface software vulnerabilities can accelerate discovery of latent supply-chain issues but also generate false positives and require human validation. Industry testing reported by BetaKit and Mozilla indicates high recall in at least one evaluation, but public reporting does not provide a reproducible benchmark, attack-surface coverage metrics, or details on exploitability rates. For practitioners, integrating model-flagged findings into secure development lifecycles typically demands triage tooling, vulnerability scoring, and secure disclosure processes.

Industry reporting frames the Glasswing rollout as concentrating access among large US cloud and tech providers, which has prompted discussion about national risk and control over advanced tooling. Editorial analysis: observers tracking sovereign-AI debates note a recurring pattern where advanced defensive or offensive cyber tooling concentrated in foreign platforms raises policy pressure for domestic capability and regulatory scrutiny.

Observers should follow third-party evaluations of Mythos's precision and exploitability claims, any documented vulnerabilities that originate from model outputs, changes in access policy for Glasswing, Canadian government commentary or procurement guidance, and whether independent security researchers replicate Bobby Holley's findings.