Anthropic Built an AI That Found Thousands of Zero-Days — And Won’t Let You Have It

Project Glasswing gives world-class vulnerability discovery to ~50 companies while the rest of the internet waits.

A steel specimen drawer labeled GLASSWING. Most vulnerabilities stay pinned under glass. One is missing.

On April 7, Anthropic announced Project Glasswing, a cybersecurity initiative backed by Nvidia, Google, AWS, Apple, Microsoft, JPMorgan Chase, and others. Claude Mythos Preview, an unreleased frontier model, powers it. Anthropic says the model has “already found thousands of high-severity vulnerabilities, including some in every major operating system and web browser.”

The model found those bugs and “developed many related exploits — entirely autonomously, without any human steering.”

Anthropic is not releasing Mythos Preview to the public. Access goes to roughly 50 “defensive security partners,” subsidized by $100 million in usage credits. If adversaries get the same tool, Anthropic argues, defenders gain nothing.

The open-source maintainers who actually build the software where those vulnerabilities live aren’t on the partner list. And Anthropic accidentally published its own source code to the internet five days before announcing Glasswing.

How Defensive Security Normally Works

Defensive capabilities in cybersecurity spread as fast as possible, or they don’t work. Researchers find a vulnerability, disclose it, everyone patches. Someone builds a better scanner, they publish it. A bug that only one company knows about is a bug that everyone else still has.

Fuzzers and static analyzers are overwhelmingly open-source. The faster defenders adopt them, the safer everyone gets.

Anthropic is bucking that convention.

What Mythos Preview Can Actually Do

Mythos Preview can “surpass all but the most skilled humans at finding and exploiting software vulnerabilities,” Anthropic says. They didn’t train it for cybersecurity. The capability comes from “strong agentic coding and reasoning skills.”

The model read through codebases, identified security flaws, wrote working exploits to prove they were real. No human told it where to look.

Anthropic published examples on their red team blog: real vulnerabilities in Firefox, working exploit chains, detailed writeups. Those are verifiable. They back up the broader “thousands” claim, even though Anthropic won’t disclose most of the specific bugs for responsible disclosure reasons.

Newton Cheng, Anthropic’s cyber lead for frontier red teaming, told The Verge the company has “been in ongoing discussions with US government officials about Claude Mythos Preview and its offensive and defensive cyber capabilities.”

“For cyber defenders to come out ahead, we need to act now.” — Anthropic, Project Glasswing announcement

Nobody outside Anthropic has independently verified the “thousands” count. Nvidia, Google, AWS, Apple, and Microsoft don’t sign onto cybersecurity partnerships for PR. They ran the model against their own systems. A $100 million credit commitment and $4 million in donations to the Linux Foundation and Apache Software Foundation tell you their partners found enough value to justify staying.

The Access Gap

Anthropic’s logic for restricting Mythos Preview makes sense on its face. Give every hacker on earth a tool that finds and exploits zero-days autonomously, and you haven’t leveled the playing field. Attackers need one unpatched system. Defenders need to find and fix all of them.

Roughly 50 organizations get access. Millions of software projects do not.

The open-source ecosystem (Linux kernel, Apache projects, npm packages, Python libraries) runs most of the world’s infrastructure. The Linux Foundation is a Glasswing partner, which helps. The individual maintainers writing and reviewing the code where these vulnerabilities live are not the ones running Mythos Preview scans.

Anthropic itself acknowledges that “it will not be long before such capabilities proliferate, potentially beyond actors who are committed to deploying them safely.” Their partners get months or years of advance warning while smaller organizations get nothing, and Anthropic has said publicly this capability will proliferate regardless.

Anthropic extended access to over 40 additional organizations beyond the 12 named partners and donated $4 million to open-source security foundations. But 52 organizations is a rounding error in a software ecosystem with millions of active repositories, and the donation doesn’t put Mythos Preview in the hands of maintainers. Anthropic could publish the vulnerabilities it finds to affected projects directly. That would be the responsible disclosure equivalent for AI-assisted security research.

Anthropic Can’t Keep Its Own Secrets

On March 26, 2026, Fortune reported that someone at Anthropic had leaked Claude Mythos Preview’s existence. Anthropic attributes this to “human error.” Dianne Penn, Anthropic’s head of product management, told The Verge the company is “taking steps in terms of solidifying our processes.”

Five days later, on March 31, a source code leak of Anthropic’s Claude Code product spread across the internet. Security researcher Chaofan Shou spotted an accidentally included source map file in version 2.1.88 of the @anthropic-ai/claude-code npm package. 512,000 lines of internal code, system prompts, feature flags, and developer comments hit the internet.

Anthropic confirmed: “This was a release packaging issue caused by human error, not a security breach.”

And the code that “leaked” was never protected to begin with. Claude Code ships as a single minified JavaScript file on npm with zero obfuscation.

Within 24 hours of the leak, a clean-room Rust rewrite called Claw Code hit 50,000 GitHub stars, making it the fastest-growing repository in GitHub history. Hackers started distributing the leaked code with malware bundled in. Wired covered the malware-laden distributions that same week.

Anthropic wants the world to trust it with a tool that can autonomously find critical vulnerabilities in any software. Anthropic can’t stop accidentally publishing its own source code.

The Claude Code leak and the Mythos reveal involve different teams and different products. Internal security for a research model is not the same as release packaging for a CLI tool. Both incidents stem from the same root cause: Anthropic’s internal processes for handling sensitive assets broke down in the same week. A company that accidentally publishes its model’s existence one day and can’t keep its source code out of public npm registries five days later has a process problem, and process problems don’t stay contained to one team.

The Clock Is Ticking

AI-assisted vulnerability discovery is about to become commodity. The companies that got early access to Mythos Preview will have spent months patching their systems by then. Everyone else will be playing catch-up against adversaries who had the same window to develop attacks.

Anthropic cites a $500 billion annual cost of cybercrime in its Glasswing announcement. That number won’t shrink because one company built a walled garden around its security tool. It might grow, because Anthropic proved the capability exists and containment is their strategy for handling it.

This is how cybersecurity has worked for decades: you find a bug, you tell the project that has it, you give them time to patch. Anthropic doesn’t need to open-source Mythos. The bugs it finds belong to the projects that have them.

So What

Anthropic built something that finds critical vulnerabilities in every major OS and browser, at scale. That part is not in dispute.

Anthropic is also the company that leaked its own model’s existence through human error, published its source code to the internet five days later, and shipped unobfuscated code to a public package registry for years. Glasswing asks you to trust them to handle the most sensitive security tool in AI history. Their track record makes that a hard sell.

Can Anthropic keep Mythos contained long enough for the restricted-access model to matter? Or are they just buying time for their partners while the rest of the software ecosystem stays exposed? When the next frontier model from a company with fewer scruples about access restrictions finds the same vulnerabilities Anthropic’s partners are quietly patching, the defenders Anthropic left off the list won’t have months of advance warning. They’ll have nothing.