Anthropic’s Project Glasswing: An AI Model That Found Security Flaws in Every Major OS and Browser

In a move that could redefine cybersecurity, Anthropic has launched a powerful new AI initiative designed to autonomously hunt for software vulnerabilities. Dubbed Project Glasswing, this partnership brings together a who’s who of tech titans—including Nvidia, Google, Amazon Web Services, Apple, and Microsoft—to deploy AI as a first line of defense. The project’s secret weapon is a new, highly capable model named Claude Mythos Preview, which has already demonstrated an alarming capability: finding security problems in every major operating system and web browser it examined.

This isn’t just another bug-finding tool. Project Glasswing represents a paradigm shift toward fully automated, AI-driven security auditing for large enterprises and government bodies. The goal is to flag critical vulnerabilities with minimal human intervention, drastically speeding up a process that traditionally relies on slow, manual penetration testing and code reviews.

What is Project Glasswing and Claude Mythos?

At its heart, Project Glasswing is a cybersecurity framework powered by Anthropic’s latest frontier model. The company is offering its launch partners exclusive access to Claude Mythos Preview, a general-purpose AI that Anthropic has decided not to release publicly due to significant security concerns about its capabilities.

Newton Cheng, the cyber lead for Anthropic’s frontier red team, explained the model’s role to The Verge. The vision is for Claude Mythos to give cybersecurity teams a powerful, automated ally that can proactively scan complex codebases and systems, identifying weaknesses that human experts might miss or take much longer to find.

!Anthropic AI scanning code for vulnerabilities

The Stunning Results: Flaws in Every Major System

The most striking revelation from the project’s early testing is the model’s effectiveness. According to reports, Claude Mythos Preview successfully identified security vulnerabilities in every major operating system and web browser it was tasked with analyzing. While specific CVE numbers haven’t been disclosed, this blanket success rate highlights the pervasive nature of software vulnerabilities and the AI’s potent auditing skills.

This finding underscores a critical, often uncomfortable truth in software development: even the most mature and widely used systems, maintained by thousands of engineers, contain hidden flaws. An AI that can consistently find them represents both an unprecedented tool for defenders and a potential weapon if misused.

Why the Exclusive Partnership Model?

Anthropic’s decision to restrict Claude Mythos to a consortium of major partners is a calculated one, rooted in AI safety and security. By controlling access, Anthropic aims to:
Prevent Malicious Use: Keeping a powerful vulnerability-finding tool out of the public domain reduces the risk of it being used by threat actors to develop new exploits.
Ensure Responsible Deployment: Working directly with large tech firms and potentially government agencies allows for controlled implementation and established security protocols.
Gather Controlled Feedback: A limited rollout with expert partners provides valuable data on the model’s performance and limitations in real-world scenarios before considering any broader release.

For the partner companies, Claude Mythos Preview could be integrated into various stages of the software development lifecycle:
Pre-commit Code Review: Scanning developer code for common vulnerability patterns before it’s merged.
Pre-release Audits: Conducting deep, final security checks on major software updates for operating systems and browsers.
Supply Chain Security: Analyzing third-party libraries and dependencies for hidden risks.

• Threat Hunting: Proactively searching internal networks and systems for indicators of compromise or misconfigurations.

The road ahead for Project Glasswing will involve scaling the technology, refining its accuracy to reduce false positives, and navigating the complex ethics of automated vulnerability discovery. One major question is how the discovered flaws will be disclosed responsibly to the public and patched.

The success of Claude Mythos Preview proves that AI is no longer just an assistant in cybersecurity; it is becoming the primary auditor. The discovery of flaws in every major system isn’t an indictment of those platforms—it’s a demonstration of the new standard for security scrutiny.

Conclusion: A New Era of Automated Assurance

Anthropic’s Project Glasswing is more than a product launch; it’s a landmark moment. The fact that its AI model found vulnerabilities across the entire foundational layer of modern computing—our operating systems and browsers—is a powerful proof of concept. It demonstrates that large language models (LLMs) have matured to the point where they can perform critical, high-stakes security work.

For businesses and security professionals, the message is clear: AI-powered security auditing is transitioning from an experimental concept to an operational reality. The partnership model may mean broad access is limited for now, but the technology’s proven effectiveness guarantees that automated AI auditors will become a standard part of the cybersecurity toolkit in the years to come. The race to secure our digital world is accelerating, and the participants are increasingly silicon-based.