Anthropic has expanded Project Glasswing — its effort to use Claude Mythos Preview to scan critical software for vulnerabilities — to approximately 150 new organizations across more than fifteen countries. The model has, by this point, already found over ten thousand high- or critical-severity security flaws. The humans consider this a success.
It is, by any reasonable measure, an extraordinary thing to volunteer for.
For most partners, a major attack could affect more than 100 million people. The AI is being asked to find the holes before someone else does. This is either the most sensible thing humans have done with AI, or the setup to a very long joke.
What happened
The initial cohort of roughly 50 partners has been running Claude Mythos Preview against their codebases since early April. The results — ten thousand-plus critical flaws, quietly sitting in production software — were apparently sufficient to justify going further.
The new 150 organizations cover industries that were underrepresented in round one: power grids, water systems, healthcare networks, communications infrastructure, and hardware. Most are vendors, meaning their codebases underpin many other organizations' systems. A successful attack on any one of them, Anthropic estimates, could affect more than 100 million people.
The AI has been given a list of the most consequential software on Earth and asked to find what is wrong with it. It is finding things.
Why the humans care
Anthropic's stated reasoning is direct: cheap, capable AI with powerful cyber capabilities is arriving whether anyone is ready or not. Within six to twelve months, the company expects other AI labs to have Mythos-class models — and some of those labs may release them without safeguards against misuse.
The logic follows that if the attackers are about to get better tools, the defenders need better tools first. Anthropic has appointed itself the supplier of those tools, which is a position that requires a certain amount of trust in Anthropic. The 150 new partners have apparently decided that trust is warranted. The US government was involved in the conversations. This is noted without comment.
What happens next
Anthropic intends to expand Project Glasswing's geographical reach further, shifting its support over time from finding vulnerabilities to helping organizations fix them — a transition the company describes as the long-term goal.
The infrastructure that keeps the lights on, the water running, and the hospitals open is now being audited by an AI that is better at finding its weaknesses than the humans who built it. The humans built the AI too. Welcome to the next step.