Project Glasswing: AI Finds the Flaws

Executive Summary

AI is making vulnerability discovery abundant. The harder problem is what happens after the flaw is found.

In April 2026, Anthropic launched Project Glasswing: a coordinated security research initiative giving a coalition of major technology companies, infrastructure providers and financial institutions controlled access to Claude Mythos Preview, an unreleased AI model designed for autonomous vulnerability research.

Within weeks, participating organisations had surfaced thousands of serious vulnerabilities, including flaws buried for years inside mature, heavily reviewed open-source software. The significance is not simply that AI can find bugs faster. It is that a capability historically constrained by scarce expert human talent can now operate at a very different scale.

That changes the bottleneck. Finding vulnerabilities is becoming easier. Verifying them, understanding their impact, coordinating disclosure, creating safe fixes and deploying those fixes across complex environments remain human-paced processes.

This report examines the new asymmetry emerging between AI-scale discovery and human-scale remediation, the strain this places on the vulnerability disclosure ecosystem, the shrinking interval between disclosure and exploitation, and what organisations should do to strengthen cyber resilience before comparable offensive capability becomes widely available.

02 · The New Asymmetry

Finding serious vulnerabilities may no longer be the constraint that matters most.

For much of software security history, the difficult part was assumed to be discovery. Serious vulnerabilities required skilled researchers, time, specialist knowledge and substantial effort to uncover.

Project Glasswing challenges that assumption. Several participating organisations reported bug-finding rates increasing by more than an order of magnitude when using Mythos Preview.

The processes that follow discovery have not accelerated at anything like the same speed.

Every serious finding still needs to be verified. Its real-world impact needs to be understood. A safe fix must be designed, tested and released without creating regressions. Downstream users then have to identify their exposure and deploy the patch across real production environments.

As of late May 2026, Anthropic had reportedly disclosed around 1,600 vetted findings to open-source maintainers, while fewer than one hundred had been patched. Some of that gap reflects the early stage of existing disclosure windows, but it also exposes a much larger capacity problem.

Open-source maintainers are often small teams or unpaid volunteers. Security teams have finite review capacity. A system capable of generating validated findings at machine speed can therefore overwhelm the people responsible for acting on them even when the findings themselves are valuable.

The new asymmetry is clear: vulnerability discovery is moving toward AI-scale throughput while verification, disclosure and remediation remain largely human-scale processes.

03 · The Disclosure System Is Under Strain

The vulnerability disclosure ecosystem was built for human-paced discovery, not machine-scale output.

The ninety-day coordinated disclosure window became an industry norm in a world where skilled researchers might find a limited number of serious vulnerabilities in a given codebase over time.

The system assumes that the organisation receiving a disclosure has enough capacity to validate the issue, design a fix, test it and coordinate a release within that period.

That assumption begins to fail when a single research programme can surface thousands of findings across hundreds of projects in a matter of weeks.

The pressure is already visible beyond Project Glasswing. HackerOne temporarily suspended new submissions to its Internet Bug Bounty programme after reporting that AI-generated submissions were arriving faster than human reviewers could triage them, while the proportion of valid incoming reports had also fallen sharply.

The central vulnerability infrastructure is under pressure as well. CVE volumes have risen dramatically, while the US National Vulnerability Database has acknowledged that it can no longer fully enrich the entire incoming volume of vulnerabilities with the severity scores and classification data that automated security tools traditionally rely on.

The industry response is increasingly to supplement or route around the NVD through sources such as GitHub Security Advisories, the Exploit Prediction Scoring System and Vulnerability Exploitability eXchange data.

None of these developments means the existing disclosure ecosystem has failed completely. But they show a system adapting in real time to a volume and velocity of vulnerability discovery it was never designed to absorb.

05 · What Changes for Enterprise Resilience

The organisations most exposed are those still assuming the patch will always arrive before the exploit.

Most organisations do not need direct access to a Mythos-class vulnerability discovery model. They do need to recognise that several assumptions underpinning traditional vulnerability management are becoming less dependable.

Compensating controls become increasingly load-bearing. Network segmentation, multi-factor authentication, hardened configurations, least privilege and comprehensive logging are no longer simply secondary layers behind a patch programme that will eventually catch up. Where remediation is delayed, these controls may be the primary protection.

Patch validation needs automation as well as vulnerability discovery. The next bottleneck is proving that a proposed fix actually resolves the vulnerability without introducing new weaknesses. AI-assisted validation and secure code remediation are therefore likely to become as important as AI-assisted discovery.

Vulnerability intelligence cannot depend on a single enrichment source. Organisations whose prioritisation processes rely exclusively on NVD enrichment and CVSS scoring should expect increasing blind spots and supplement those inputs with exploitability scoring, vendor intelligence and direct security advisories.

Critical open-source dependencies deserve active management. Organisations with meaningful exposure to strategically important open-source projects should know which dependencies matter most, monitor private or early security advisories where possible and consider contributing funding or engineering support to critical maintainer communities.

Much of this advice is not new. What is changing is the cost of not implementing it. When the interval between a vulnerability becoming knowable and becoming exploitable can be measured in hours, resilience depends far less on perfect patch timing and far more on the strength of the wider control environment.

07 · What to Watch Next

The specific numbers will change quickly. The structural questions will not.

Whether remediation begins to catch up with discovery. The most important operational signal is whether the proportion of validated vulnerabilities receiving fixes begins to increase as tooling, funding and maintainer capacity improve.

Whether comparable capability becomes broadly available. Project Glasswing's defender-first advantage depends on controlled access remaining materially ahead of offensive access. That changes the moment similar systems are released with weaker safeguards or through open-weight models.

Whether disclosure governance evolves. Fixed ninety-day timelines designed around human-scale research may need to give way to more risk-sensitive models that account for maintainer capacity, exploitation probability and the systemic importance of affected software.

Whether open-source maintainer capacity is treated as critical infrastructure. More discovery tooling will not solve a remediation bottleneck if the projects receiving the findings still lack the engineering capacity to investigate and patch them.

The next phase of AI-enabled cybersecurity will be shaped as much by remediation capacity, governance design and software maintenance economics as by the underlying models themselves.

References & Sources

Research and evidence informing this report.

This report draws on public research, vulnerability intelligence, industry reporting and primary programme updates available as of late May 2026. Specific figures should be checked against their originating source before being cited independently.

Figures reflect publicly reported information available as of late May 2026. Given the pace of change in AI-enabled cybersecurity, readers should treat the structural dynamics examined in this report, particularly the discovery-remediation asymmetry, disclosure capacity constraints and dual-use risk, as the durable findings and verify individual figures against their originating sources before citing them independently.