{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/anthropic-glasswing-initial-update-2026/",
 "asOf": "2026-09-26",
 "id": "anthropic-glasswing-initial-update-2026",
 "date": "2026-05-22",
 "datePrecision": "day",
 "title": "Glasswing update: over 10,000 high-severity bugs found, but only 75 of 530 disclosed OSS bugs patched",
 "lane": "defense",
 "kind": "program",
 "summary": "Anthropic reports that about 50 Glasswing partners used Claude Mythos Preview to find more than ten thousand high- or critical-severity vulnerabilities, and that its own scan of over 1,000 open-source projects produced 6,202 model-estimated high/critical findings. Of 1,752 assessed, mostly by six independent firms, 90.6% were true positives; Anthropic estimates 530 high/critical bugs disclosed, of which 75 were patched, and says triage and patching capacity, not discovery, is the bottleneck.",
 "whyItMatters": "It gives rare pipeline-level numbers showing AI vulnerability discovery outpacing the human capacity to verify, disclose and fix.",
 "actors": [
  "anthropic",
  "cloudflare",
  "mozilla",
  "uk-aisi",
  "xbow",
  "palo-alto-networks",
  "microsoft",
  "oracle",
  "wolfssl"
 ],
 "topics": [
  "vulnerability-discovery",
  "vulnerability-repair",
  "incident-reporting",
  "access-controls"
 ],
 "atlas": [
  "human-approver",
  "access-gate",
  "model"
 ],
 "artifacts": [
  "project-glasswing",
  "claude-mythos"
 ],
 "sources": [
  {
   "url": "https://www.anthropic.com/research/glasswing-initial-update",
   "publisher": "Anthropic",
   "title": "Project Glasswing: An initial update",
   "date": "2026-05-22",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "Mythos Preview estimated 6,202 high- or critical-severity vulnerabilities (of 23,019 total) across more than 1,000 open-source projects.",
   "locator": "Section 'Open-source software'"
  },
  {
   "fact": "Of 1,752 high/critical findings assessed by six independent firms or, in a few cases, Anthropic, 90.6% (1,587) were valid true positives and 62.4% (1,094) confirmed high or critical.",
   "locator": "Section 'Open-source software'"
  },
  {
   "fact": "An estimated 530 high/critical bugs disclosed to maintainers, with 827 more confirmed and awaiting disclosure; 75 patched and 65 with public advisories; average time to patch a high/critical bug about two weeks.",
   "locator": "Section 'Open-source software'"
  },
  {
   "fact": "Mozilla found and fixed 271 vulnerabilities in Firefox 150 while testing Mythos Preview; Cloudflare found 2,000 bugs, 400 high or critical.",
   "locator": "Section 'Evidence from our partners and external testers'"
  }
 ],
 "significance": 5,
 "fideQuestions": [
  "FID-076",
  "FID-077",
  "FID-088"
 ],
 "methods": [
  "ai-vulnerability-discovery",
  "automated-patching"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}