AI Discovers 10,000 Critical Vulnerabilities in Global Software Infrastructure

In what security researchers are calling one of the most consequential cybersecurity initiatives in recent memory, Anthropic's Claude Mythos AI has autonomously uncovered more than 10,000 high- and critical-severity vulnerabilities across the world's most systemically important software — all within just a few weeks of operation. The initiative, known as Project Glasswing, represents the first large-scale deployment of a frontier AI model as an offensive security tool turned defensive weapon, and its early results are reshaping how the industry thinks about vulnerability discovery, patch timelines, and the future of software safety.

Anthropic disclosed the milestone figures on May 23, 2026, confirming that of the more than 10,000 vulnerability candidates surfaced by Mythos Preview, 6,202 were classified as high- or critical-severity flaws affecting more than 1,000 open-source projects. Subsequent human and automated analysis confirmed 1,726 as valid true positives, with 1,094 assessed as high- or critical-severity. So far, 97 findings have been patched upstream by affected software maintainers, and 88 security advisories have been issued. The pace of discovery has set off alarm bells — and urgent keyboard strokes — across the global software supply chain.

What Is Project Glasswing?

Project Glasswing is a coordinated vulnerability disclosure initiative launched by Anthropic in April 2026, built around Claude Mythos Preview — the company's most capable AI model to date, with a particular specialization in computer security tasks. Rather than releasing Mythos to the public, Anthropic structured access through a 12-partner coalition of leading technology and infrastructure organizations. Access to Mythos is restricted to vetted, critical-infrastructure operators operating under strict responsible disclosure agreements.

The partner list reads like a who's who of the global technology stack: AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks. Anthropic has committed up to $100 million in Mythos Preview usage credits across these partners, as well as $4 million in direct donations to open-source security organizations. The program's name — Glasswing — references a transparent-winged butterfly, a nod to the initiative's goal of making software infrastructure visible, legible, and ultimately hardened against attack.

Technical Capabilities: How Mythos Hunts Vulnerabilities

Claude Mythos Preview's security capabilities go well beyond pattern-matching or static analysis. The model operates with a genuine security mindset — it reads source code, understands program logic, hypothesizes attack surfaces, generates exploit payloads, and chains multiple weaknesses into multi-step attack paths. Autonomous offensive security platform XBOW, which evaluated Mythos against its own benchmarks, described the model as "a major advance" that is "substantially better than prior models at finding vulnerability candidates" and "adept at analyzing source code with a security mindset."

The FreeBSD discovery is particularly instructive. CVE-2026-4747 is a critical remote code execution flaw in the NFS implementation that had existed undetected in the codebase for 17 years. The vulnerability allows an unauthenticated attacker on any network to obtain complete root control over an affected server. Mythos identified it, developed a working proof-of-concept exploit, and reported its findings — entirely autonomously. No human was involved in the discovery or exploitation chain after the initial task prompt was issued.

Among the most significant confirmed findings is CVE-2026-5194, a critical vulnerability in WolfSSL — one of the most widely deployed embedded TLS libraries in the world — carrying a CVSS score of 9.1. The flaw allows an attacker to forge TLS certificates and impersonate legitimate services, creating a universal man-in-the-middle attack vector in environments ranging from IoT devices to enterprise network appliances. Additional highlights from Project Glasswing's findings include:

• Zero-day vulnerabilities confirmed across every major operating system and every major web browser
• Critical flaws in widely deployed cryptographic libraries enabling certificate forgery and traffic interception
• Multi-step exploit chains discovered autonomously, combining lower-severity weaknesses into high-impact attack paths
• Vulnerabilities in open-source components embedded in thousands of downstream commercial products
• A 17-year-old unauthenticated RCE flaw in FreeBSD's NFS stack that had survived all prior audits

Beyond Vulnerability Discovery: Real-World Defense

Project Glasswing's utility has already extended beyond pure vulnerability research. In a striking early demonstration of AI-assisted threat detection, a Glasswing partner bank leveraged Mythos to detect and block a fraudulent $1.5 million wire transfer in real time. The attack chain began with a business email compromise — an unknown threat actor breached a customer's email account and supplemented the digital attack with convincing spoof phone calls to the bank's verification staff. Mythos, analyzing behavioral patterns across the transaction and communication data, flagged the fraud before funds left the institution.

This incident signals something important: the same AI capability that finds software vulnerabilities can also recognize the signatures of social engineering, account compromise, and financial fraud — all in near real time. The convergence of AI-powered offensive capability and AI-powered defense is accelerating simultaneously, and organizations that deploy these tools defensively first will hold a significant advantage.

The Patch Gap Crisis — and Why It's Getting Worse

The timing of Project Glasswing's disclosures has thrown a harsh spotlight on an already-worsening problem: the gap between when vulnerabilities are discovered and when they are patched. Mandiant's M-Trends 2026 report, published earlier this year, found that 28.3% of CVEs are now being exploited within 24 hours of public disclosure — and the average time for organizations to remediate a known high- or critical-severity CVE remains 74 days. That 74-day window is a chasm that sophisticated threat actors, and increasingly AI-assisted attackers, are readily exploiting.

Anthropic has been candid about the tension at the heart of Project Glasswing. The relative ease with which Mythos discovers vulnerabilities — compared to the complexity and slowness of patching them — creates a structural imbalance that the initiative alone cannot solve. "Confronting this challenge successfully will make our software far safer than before," Anthropic stated in its May 23 disclosure, while simultaneously urging software vendors to dramatically shorten their patch cycles. Oracle has already moved to a monthly critical patch cycle in response to AI-assisted discovery trends, and Microsoft has indicated its monthly patch volume will "continue trending larger for some time."

Anthropic is not releasing the details of the more than 10,000 vulnerability candidates, noting that over 99% have not yet been patched — and that doing so "would be irresponsible" under standard coordinated vulnerability disclosure protocols. This also means the full scope of risk exposure will remain partially hidden until patches are issued, which may take months or years for the full portfolio of affected open-source projects.

Access Controls, Governance, and the Broader Arms Race

Anthropic has been deliberate about keeping Mythos Preview out of public hands, and for good reason. The company has stated explicitly that "there currently exist no adequate safeguards to prevent [its] misuse at a large scale." This mirrors the position taken by OpenAI, which similarly restricted its security-specialized GPT-5.5-Cyber model behind a vetting program called Daybreak for authorized defenders. The emerging pattern — AI companies racing to deploy their most capable security models in controlled, vetted environments before adversaries can access comparable capability — is likely to define the cybersecurity landscape for the next several years.

Anthropic has also launched a Cyber Verification Program alongside Project Glasswing, allowing vetted security professionals — penetration testers, red teamers, and vulnerability researchers — to use Claude models without certain default safety guardrails, for explicitly legitimate research purposes. This is a significant policy shift, acknowledging that the most valuable defensive applications of frontier AI require operating in the same capability space that would otherwise raise misuse concerns.

Looking Ahead

The implications of Project Glasswing will unfold over months and years. In the near term, watch for a surge in security advisories and patch releases from major open-source projects as Glasswing partners work through the coordinated disclosure pipeline. Microsoft, Google, Apple, and Linux Foundation maintainers are all actively triaging Mythos-sourced findings, and the volume of patches expected in H2 2026 is likely to be historically unprecedented. Oracle's shift to monthly critical patching is an early indicator of how large vendors are adapting their release cadences in response to AI-accelerated discovery timelines.

Longer-term, Project Glasswing is a proof-of-concept for a new model of infrastructure security: AI-as-continuous-auditor, running autonomously against critical codebases at a scale and speed no human team could match. If the program achieves its stated goal of making the world's most systemically important software substantially safer, it could represent one of the most impactful applications of AI capability in 2026. The question now is whether the patch ecosystem — and the humans who maintain it — can keep pace with what the machines are finding.

For organizations outside the Glasswing coalition, Anthropic's guidance is actionable and urgent: shorten patch testing and deployment timelines, enforce multi-factor authentication universally, harden network default configurations, and maintain comprehensive logs for detection and response. The window between discovery and exploitation is shrinking. The organizations that close it fastest will be the ones still standing when the next generation of autonomous exploit agents — adversarial ones — arrives on the scene.