Anthropic published an initial Project Glasswing update on May 22, 2026 with a direct message: AI is shifting cybersecurity's bottleneck from finding vulnerabilities to verifying, disclosing, and patching them fast enough. That is a more important change than a single model benchmark.
Project Glasswing is Anthropic's collaborative effort to secure critical software before more capable AI models can be misused by attackers. Anthropic says roughly 50 partners have used Claude Mythos Preview in recent weeks to find more than 10,000 high- or critical-severity vulnerabilities.
The partner evidence is striking. Anthropic says most partners found hundreds of high- or critical-severity issues after one month, and several reported more than a 10x increase in bug-finding rate. Cloudflare found 2,000 bugs across critical-path systems, including 400 high- or critical-severity issues, with a false positive rate its team considered better than human testers.
The open-source scan is just as important. Anthropic says Mythos Preview scanned more than 1,000 open-source projects and estimated 6,202 high- or critical-severity vulnerabilities. After assessment by six independent security research firms and some Anthropic review, 90.6% of a triaged subset were valid true positives, while 62.4% were confirmed high or critical.
Those numbers should not be reduced to "AI replaces security teams." Anthropic's real point is almost the opposite: the new constraint is human capacity. Triage, reporting, patch design, deployment, and coordinated disclosure still require maintainers, vendors, and security researchers. Some maintainers have even asked Anthropic to slow disclosure because they need more time to design patches.
For companies, the lesson is that security workflows need redesign. AI can accelerate discovery, but without vulnerability classification, ownership, disclosure strategy, patch scheduling, and validation, more findings simply create a larger backlog. AI security capability is not the same as security outcome. Throughput across the whole process is what matters.
Project Glasswing is also a warning for every team deploying AI agents. The more agents can reach tools, codebases, and systems, the more mature permissions, auditability, and remediation need to become. Glasswing is not just a tool story. It is a stress test between AI discovery capacity and human governance capacity.
