Wednesday Jun 3
GOVERNANCEAnthropic

Glasswing Goes Critical Infrastructure

2JUN
150 PARTNERS!MYTHOS15+ COUNTRIES

Anthropic, the maker of Claude, extends Project Glasswing to roughly 150 new organizations across 15+ countries. The expanded cohort covers power, water, healthcare, communications, and hardware - sectors where a successful attack could affect 100M+ people.

First wave (50 partners, April) found 10,000+ critical vulnerabilities. Mozilla fixed 271 Firefox bugs - 10x the previous baseline. Cloudflare flagged 2,000, with 400 high or critical.

The new group targets critical infrastructure - vendors whose codebases run governments, utilities, and global comms. Anthropic also shipped Claude Security, a public product using Opus 4.8 to scan codebases and suggest patches. Dario Amodei's lab is setting the playbook before competitors hit the same capability. Their own warning: Mythos-class models arrive at other labs in 6 to 12 months, possibly without safeguards. The bottleneck has shifted from finding bugs to patching and disclosing them at scale.

For PMs in security, the threat surface just collapsed and re-expanded at once. Procurement is shifting from 'find more bugs' to 'patch faster.' Expect every major vendor to ship an AI security product within 90 days.

full brief & sources

⚡ Why this matters

  • AI cybersecurity moves from research demo to global infrastructure layer.
  • Anthropic sets the disclosure + patching norm before peers ship Mythos-class models.
  • Claude Security launches as a public product, not just a research preview.

🔍 What happened

  • 50 partners in April → 150 partners on June 2: 3x expansion.
  • Coverage spans 15+ countries; sectors include power, water, healthcare, communications, hardware.
  • First wave found 10,000+ high or critical-severity vulnerabilities.
  • Mozilla fixed 271 Firefox bugs found by Mythos - 10x the count found by Opus 4 on Firefox 148.
  • Cloudflare identified 2,000 bugs across critical-path systems; 400 rated high or critical.
  • Mythos scanned 1,000+ open-source projects, flagged 23,019 vulnerabilities; 6,202 high or critical, 90%+ confirmed valid.
  • Claude Security launched as a public product powered by Opus 4.8.

💬 Smart takes

  • Anthropic: 'Within 6 to 12 months, we expect that many other AI companies will have Mythos-class models, and they could release them without safeguards that prevent misuse.'
  • Anthropic: 'The bottleneck in cybersecurity is now verifying, disclosing, and patching the large numbers of vulnerabilities that Mythos-class models can surface.'
  • Skeptic: The asymmetry concern - offense scales faster than open-source maintainer capacity to triage and patch, even with AI assistance.

🧭 Where this goes

  1. Within 90 days, OpenAI, Google, and Microsoft ship parallel Mythos-class security programs.
  2. Patch infrastructure becomes the new bottleneck. Third-party Patch-as-a-Service vendors emerge.
  3. National governments mandate vuln-disclosure norms tied to AI capability tiers.
  4. Open-source maintainer comp shifts from sponsor money to AI-found bug triage credits.

🎯 Implication

  • For PMs: Audit your dependency chain. Anthropic's 23,019 OSS bugs include packages you ship.
  • For execs: Budget for a security AI line item in 2027. The 'no AI in security' stance is now untenable.
·Anthropic - Glasswing expansion·TechCrunch - 15+ countries scaled·SecurityWeek - 271 Firefox bugs·CyberScoop - Critical infrastructure