IC Technology & Surveillance — 2026-04-13

Anthropic Deploys Restricted AI Model Through Project Glasswing to Find Critical Software Vulnerabilities with CISA Engagement

Anthropic launched Project Glasswing with eight major technology companies to deploy its restricted Claude Mythos Preview model for defensive cybersecurity. The model identified thousands of zero-day vulnerabilities in major operating systems and browsers during testing, including a 27-year-old flaw in OpenBSD. Anthropic is withholding the model from public release due to its offensive potential and has engaged CISA and CAISI on governance. The initiative follows Anthropic's warning that within two years AI models will uncover vast numbers of software vulnerabilities that have sat unnoticed in code for years.

Analysis
Glasswing represents the first structured attempt to weaponize frontier AI for defensive vulnerability discovery at scale. The 27-year-old OpenBSD flaw is the headline, but the systemic implication is that AI-discovered vulnerabilities will outpace human patching capacity, creating a window where defenders know about flaws faster but cannot fix them faster. Anthropic's decision to withhold public access while engaging CISA reflects a judgment that the offensive potential outweighs the defensive benefit if broadly distributed. This position may not survive competitive pressure from less cautious labs.

2 sources