Anthropic Launches Project Glasswing to Fix Software Bugs With AI

https://www.infosecurity-magazine.com/news/anthropic-launch-project-glasswing/

Publish Date: 2026-04-08 07:30:00

Source Domain: www.infosecurity-magazine.com

AI firm Anthropic has launched Project Glasswing, an initiative which uses AI to identify and remediate undiscovered cybersecurity vulnerabilities in critical software.

Project Glasswing, named after the glasswing butterfly, is based on Claude Mythos Preview, a powerful, not publicly available, version of Anthropic’s Large Language Model (LLM).

The company described the model as the “most capable yet for coding and agentic tasks” and that it can “deeply understand and modify complex software,” allowing Claude Mythos Preview to autonomously find and fix cybersecurity vulnerabilities at scale.

Anthropic did not train it specifically for cybersecurity, rather it said the capabilities are the result of its “strong agentic coding and reasoning skills.”

Announced publicly on April 7, the capabilities of Claude Mythos Preview have already been tested by Anthrophic’s launch partners for Project Glasswing. These include Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks.

In testing, the model discovered thousands of zero-day vulnerabilities which had not previously been identified. These included:

A 27-year-old vulnerability in OpenBSD, a security-hardened UNIX-like operating system used to run firewalls and other critical infrastructure. The vulnerability allowed an attacker to remotely crash any machine running the operating system just by connecting to it
A 16-year-old vulnerability in FFmpeg, which is commonly used in software to encode and decode video. The vulnerability was discovered in a line of code that automated testing tools had hit five million times without it previously identified
The model autonomously found and chained several vulnerabilities in the Linux kernel, the software which is used to run most of the world’s servers, to allow an attacker to escalate from ordinary user access to complete control of the machine

Anthropic said…

Source