Project Glasswing
Anthropic-led initiative (April 2026) to secure critical software using Claude Mythos Preview, a frontier model that finds and exploits vulnerabilities at near-expert-human level, deployed defensively with major industry partners.
Glasswing exists because Mythos Preview already found thousands of high-severity zero-days in every major OS and browser, with exploits developed autonomously in many cases. Anthropic is not releasing Mythos Preview broadly; goal is defensive scale first while safeguards mature. Source: anthropic.com/glasswing, 2026-04-07
Partners and resources
Launch partners include AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks. Anthropic committed up to $100M in Mythos usage credits plus $4M to open-source security orgs; 40+ additional critical-infrastructure maintainers get access. Source: anthropic.com/glasswing, 2026-04-07
The original source thread adds three operational constraints worth preserving: Anthropic said it did not plan to make Mythos Preview generally available, committed to report back on what partners learn, and separated the Glasswing initiative from the Mythos Preview system card. Treat the bookmark as restricted defensive-deployment evidence, not as a normal model-routing option. Source: X/@AnthropicAI thread, 2026-04-07; Source: Claude Mythos Preview system card, 2026-04-07
Example findings (patched subset)
- 27-year-old OpenBSD remote crash vulnerability. Source: anthropic.com/glasswing, 2026-04-07
- 16-year-old FFmpeg bug in code hit five million times by automated tests without detection. Source: anthropic.com/glasswing, 2026-04-07
- Chained Linux kernel issues found autonomously. Source: anthropic.com/glasswing, 2026-04-07
Technical report: Anthropic Frontier Red Team blog (Mythos Preview). Source: X/@AnthropicAI thread, 2026-04-07
Relevance to Kevin
Validates agent-powered vuln scanning (Security and Review Skills, security automations). Glasswing is vendor-scale defensive deployment; Mythos is not a general coding model. Claude Fable 5 (June 2026) is the generally available Mythos-class model with safeguards; Claude Mythos 5 (same underlying model, fewer safeguards) remains restricted to Glasswing partners until trusted-access expands. Source: X/@claudeai thread, 2026-06-09 Cross-ref Claude Code Harness for harness-side security practices.
For Long Live Hard SaaS, Glasswing is evidence for harnessed bug discovery rather than evidence that SaaS is dead. Cloudflare's writeup says generic coding agents are the wrong shape for broad vulnerability coverage and describes a multi-stage harness with narrow scopes, adversarial validation, parallel hunts, dedupe, tracing, and reporting. That is a model-plus-process system, not one-shot bug-free software. Source: Cloudflare Blog, 2026-05-18
The reviewed Eugene Yan artifact is the compact bookmark form of Cloudflare's harness: Recon, Hunt, Validate, Gapfill, Dedupe, Trace, Feedback, and Report. It should route readers to Harness Engineering for the reusable loop and back here for the Project Glasswing / Mythos-specific deployment context. Source: X/@eugeneyan and local image review, 2026-07-04
Signal
42,231 likes, 15,374 bookmarks on announcement tweet. Source: X/@AnthropicAI, 2026-04-07
Timeline
- 2026-07-04 | Added the Eugene Yan Cloudflare diagram as artifact evidence for the Glasswing harness and linked it back to Harness Engineering. Source: X/@eugeneyan, 2026-05-18; Source: Cloudflare Blog, 2026-05-18
- 2026-07-03 | Deep-reviewed the original Anthropic source thread and official page again for the artifact audit. Preserved the system card link and clarified the key route: Mythos Preview is a restricted defensive model for Glasswing partners, not a broadly routable coding model. Source: X/@AnthropicAI thread, 2026-04-07; Source: Anthropic Glasswing, 2026-04-07
- 2026-04-07 | Project Glasswing and Claude Mythos Preview announced. Source: X/@AnthropicAI, 2026-04-07
- 2026-05-18 | Cloudflare published results of testing Mythos against 50 of its own repos (3,964 likes, 4,805 bookmarks); Eugene Yan distilled the Recon/Hunt/Validate/Gapfill/Dedup pipeline. The lesson is architectural, not "patch faster." Source: X/@Cloudflare, 2026-05-18
- 2026-06-01 | Wiki page from enriched bookmark
2041578392852517128. Source: compiled from enrichment, 2026-06-01 - 2026-06-09 | @claudeai announced Claude Fable 5 (general) and Claude Mythos 5 (Glasswing partners): Mythos-class benchmarks, topic-based fallbacks to Opus 4.8 on sensitive domains (~5% of sessions). 104,049 likes, 21,895 bookmarks. Source: X/@claudeai thread, 2026-06-09
- 2026-06-12 | Top-25 absorption (#12) linked Fable/Mythos 5 launch to Glasswing access model. Source: x-bookmark-absorb, 2026-06-12
- 2026-06-22 | Reframed for Kevin's hard-SaaS thesis: Mythos/Glasswing improves harnessed vulnerability discovery, but still reinforces the need for scope, validation, regression, and product maintenance. Source: raw/notes/saas-bug-moat-slack-thread-2026-06-22.md; Cloudflare Blog, 2026-05-18