Anthropic's Project Glasswing: Claude Mythos Found 10,000 Critical Zero-Days in 30 Days

On May 24, 2026, Anthropic disclosed that Project Glasswing — its controlled AI-powered vulnerability research initiative — used Claude Mythos Preview to autonomously discover more than 10,000 high- and critical-severity zero-day vulnerabilities across the world’s most critical software systems in a single month. The Federal Reserve and Treasury Department convened emergency meetings with major bank CEOs. Open-source maintainers began asking Anthropic to slow its disclosure pace because they cannot patch fast enough. And Mythos — the model behind all of this — has not even been publicly released yet.

For every developer who builds on open-source dependencies, deploys software that runs on common operating systems, or ships any product that touches cryptography, authentication, or network communication, this is not a background security story. It is a fundamental shift in what AI can do to software — and to software security. The six-to-twelve month window Anthropic describes for patching before adversaries replicate the same capability is already running.

Try it yourself: Free Hash Generator — free, no signup, runs in your browser.

What Is Project Glasswing?

Anthropic built Project Glasswing out of a dilemma: Claude Mythos Preview demonstrated the ability to autonomously find and exploit software vulnerabilities at a level that surpasses most human security researchers. Shipping Mythos broadly would mean giving that capability to everyone — including adversaries. So Anthropic created a controlled access program instead.

Project Glasswing grants approximately 50 partner organizations early access to Claude Mythos Preview specifically for defensive vulnerability research. The partner list includes major technology companies, critical infrastructure operators, and security firms. The stated mission: give defenders enough lead time to find and patch critical flaws before attackers build comparable AI capabilities and begin exploiting the same vulnerabilities.

It is, in effect, an AI-powered bug bounty program at civilizational scale — run not by hackers submitting reports, but by an AI that can autonomously scan codebases, identify vulnerabilities, build working exploits, and generate detailed remediation guidance, all without stopping for lunch. Anthropic is also supplying its Glasswing partners with specialized skills, codebase-mapping harnesses, and automated threat model builders to streamline the triage process on the receiving end.

The 10,000 Number: What It Actually Means

The headline figure — 10,000+ critical vulnerabilities in one month — requires context to understand properly. Anthropic and its Glasswing partners pointed Claude Mythos Preview at more than 1,000 open-source repositories. The model flagged 23,019 potential issues across those repositories, of which 6,202 were estimated as high or critical severity. The broader "10,000+" figure encompasses high- and critical-severity flaws across all scanned systems, including major operating systems and web browsers.

The scale is staggering compared to traditional security research. A talented human security researcher might find five to fifteen significant vulnerabilities per year in a focused audit of a single codebase. Mythos found thousands in weeks across hundreds of projects simultaneously. The model does not get tired, does not miss a code path because it was scanning late at night, and does not need to context-switch between projects.

Some of these vulnerabilities were in software that has been in production for years, audited by teams of engineers, and scrutinized by security researchers who missed what Mythos found. That is not a criticism of human engineers. It is a statement about what happens when you apply a model trained on the entirety of human-written code to systematically audit software for exploitable patterns at machine speed.