Project Glasswing is Anthropic's $100 million cybersecurity initiative that uses Claude Mythos — Anthropic's most capable AI model — to find and fix zero-day vulnerabilities in critical software infrastructure. In its first seven weeks of operation, Glasswing found over 2,000 zero-day vulnerabilities across Firefox, critical infrastructure software, and partner codebases. Access is invite-only and locked behind a dedicated API endpoint.
What Is Project Glasswing?
Glasswing is a structured collaboration between Anthropic and major technology companies — including Microsoft, Apple, Google, and 9 others — to use Claude Mythos for automated vulnerability discovery. Anthropic provides $100M in model credits distributed across partners. Each partner runs Mythos against their own codebases in a sandboxed environment, with findings reported through a coordinated disclosure process.
How Claude Mythos Finds Vulnerabilities
Mythos operates as an autonomous agent: it reads source code, traces execution paths, generates exploit proofs-of-concept, and proposes patches — all without human guidance per vulnerability. Unlike traditional static analysis tools, Mythos can reason about multi-step exploit chains that span multiple files and functions, catching vulnerabilities that rule-based scanners consistently miss.
Results and Scale
The Firefox zero-day discovered by Glasswing in April 2026 was a memory corruption vulnerability in the JavaScript engine that allowed remote code execution. It had been present in the codebase for over three years. Mythos identified it in under 40 minutes — a task that previously required months of manual security research. The vulnerability was patched within 72 hours of discovery.
What It Means for Developers
Project Glasswing is the clearest signal yet that frontier AI is moving from code assistant to autonomous security agent. For most development teams, the practical implication is: security vulnerabilities that took months to find manually will be found in minutes by AI — meaning the window between a bug entering the codebase and being exploited is collapsing. Defense-in-depth and schema masking for AI-assisted development are more important than ever.