From Project Glasswing to Open Access: Lessons in Collaborative Defense

Software vulnerabilities are shared. A flaw in a Linux subsystem exists in every deployment of that subsystem. A bug in a TLS library exists in every product that ships it. That single fact favors attackers: they need to find a bug once to exploit it everywhere, while defenders working alone each have to find it again.

When discovery took months, that asymmetry was tolerable. When it takes hours, isolated defense stops making sense. Project Glasswing was the first large attempt to organize around that reality. Seven months in, it offers lessons for every security leader, whether or not your organization was ever part of it.

The Timeline

Date (2026)	Event
March 26	The existence of a model called Claude Mythos becomes public through leaked draft blog posts
April 7	Anthropic announces Claude Mythos Preview and Project Glasswing; restricted access for vetted partners; up to $100M in usage credits and $4M in donations to open-source security organizations
May 22	First progress update: roughly 50 partners report more than 10,000 high- or critical-severity vulnerabilities; 90.6% of 1,752 independently assessed open-source findings are valid
June 2	Glasswing expands to about 150 more organizations across more than 15 countries, adding power, water, healthcare and communications
June 9	Claude Mythos 5 (restricted) and Claude Fable 5 (generally available with safeguards) released
June 12	A Commerce Department directive bars foreign nationals from both models; unable to verify nationality in real time, Anthropic suspends both
June 30 - July 1	Controls lifted; Fable 5 returns globally on July 1, Mythos 5 for approved U.S. organizations
September 1	Claude Mythos 5.1 and Fable 5.1 released
October 6	Glasswing folded into an expanded Cyber Verification Program with three access tiers; existing members move to the least restricted tier

The founding partner list included AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks, with Mozilla among the early participants reporting results: it found and fixed 271 vulnerabilities in Firefox 150 while testing Mythos Preview.

How It Worked

The model was simple. Partners used Mythos to scan their own code and the open-source projects they depend on. Findings went through coordinated disclosure to the responsible maintainers. Patches flowed downstream to everyone, including organizations that never had access.

Anthropic also ran its own scanning across more than 1,000 open-source projects and disclosed directly to maintainers. By October, it reported at least 129,000 vulnerabilities verified by partners between April and July, more than 33,000 rated critical or high, plus 5,500 from its own open-source work.

The Cyber Verification Program

In October, Anthropic replaced the invitation-only structure with tiered access for vetted cybersecurity professionals:

• Defense Access: incident response, malware reverse engineering, and vulnerability analysis and validation.
• Red Team Access: everything above, plus authorized penetration testing and red teaming.
• Specialized Access: the fewest safeguards, reserved for a limited set of verified organizations, including former Glasswing members.

Models available across tiers include Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1.

Anthropic published an evaluation to show how the tiers behave: five attempts at each of 10 CyScenarioBench challenges with Claude Opus 5.5, 50 trials per tier. Defense Access safeguards blocked 46 of the 50. In the Red Team tier, none were blocked and 34 were completed, matching the success rate with no safeguards at all. Without program access, all 50 were blocked at the first prompt. These are Anthropic's own numbers.

That design addresses a problem the Hugging Face responders described in July: safeguards built to stop attackers were stopping defenders too. Tiered verification is an attempt to give defenders the capability without handing it to everyone.

What Glasswing Got Right

It bought time. Restricting the most capable model for the first months meant tens of thousands of serious bugs entered coordinated disclosure before comparable capability was widely available. Every bug fixed in that window is a permanent gain.

It put real money behind the claim. Usage credits at that scale represent an enormous amount of scanning. The direct funding for open-source security organizations acknowledged that maintainers, not models, are the bottleneck.

It focused on shared infrastructure. Scanning the open-source projects everyone depends on creates value for organizations that will never sign a partnership agreement.

It got competitors into one room. Apple, Google and Microsoft compete in almost every market they share. Seeing them collaborate on defensive scanning sets a useful precedent for other shared risks.

It expanded to critical infrastructure. The June expansion to utilities, healthcare and communications put capability where the consequences of a breach are physical, not just financial.

What It Left Unsolved

Fixing did not keep pace. The headline problem of 2026 is not discovery. With roughly 8% of disclosed open-source findings patched upstream by early October, the program proved that scanning without fix capacity grows a queue. The next phase of collaborative defense has to fund remediation, not only discovery.

Verification transparency. Several independent analysts criticized early disclosures for lacking reproduction details, which made headline numbers hard to check. The hand-reviewed sample and later outside analyses helped, but the lesson stands: in a field built on trust, publish enough for others to verify.

Identity was out of scope. Glasswing was about code. It produced no standard for how AI agents should authenticate, how their permissions should be scoped, or how their actions should be audited. Standards bodies have started: NIST's Center for AI Standards and Innovation launched an AI Agent Standards Initiative in February 2026, and its NCCoE published a concept paper on software and AI agent identity and authorization. Both are voluntary and early. The Hugging Face breach shows why that gap matters as much as code flaws.

Access remains tiered by nature. The Cyber Verification Program widens access a great deal, but verification still favors organizations with security teams, legal departments and time to apply. Small and mid-sized companies, which are often the least defended, mostly benefit downstream through patches.

Historical Precedents

Glasswing was not the first attempt at collective defense. Three precedents help predict where it goes.

OSS-Fuzz (2016 to present). Google's continuous fuzzing service for open source had helped find and fix more than 10,000 vulnerabilities and 36,000 bugs across 1,000 projects by August 2023. Lesson: sustained, multi-year investment with low friction for maintainers compounds. One-time campaigns do not.

DARPA Cyber Grand Challenge (2016). Autonomous systems found, patched and exploited bugs in real time in a competition setting. It proved feasibility, but the systems did not move into everyday production use. Lesson: demonstrations matter less than integration into normal development workflows.

Coordinated vulnerability disclosure. The norm of private reporting with a deadline, such as the 90-day policy popularized by Google Project Zero, created vendor security teams and predictable timelines. Lesson: disclosure processes built for a trickle of reports need redesign for a flood, including triage support for maintainers and clear prioritization by exploitability.

Where Collaborative Defense Goes Next

2026: Lab-led scanning. A model provider supplies capability, partners scan, and patches flow downstream. This phase is ending.

2027: Democratized discovery, coordinated remediation. Capable models are widely available. The scarce resource becomes coordination: deduplicating reports, prioritizing by real exploitation risk, and funding maintainers to ship fixes. I expect industry consortia, ISACs and foundations to take on more of this work.

2028 and beyond: Built into development. AI security review becomes as routine in CI/CD as linting and unit tests. Most bugs never reach a release. Collaborative bodies shift toward shared standards, benchmarks and agent identity governance.

Organizations that adopt AI-augmented defense in 2026 and early 2027 will carry a compounding advantage into that third phase. For the broader model landscape driving this shift, including how competition among frontier labs is accelerating capability, see my essay on the future of AI and my Grok AI hub.

What To Do If You Were Never a Member

You do not need consortium membership to benefit.

1. Absorb the flood. Expect more advisories in widely used open source. Your Tier 1 and Tier 2 patch automation from Chapter 4 is how you keep up.
2. Watch the right feeds. Track advisories from major vendors, the Linux Foundation and the open-source projects in your SBOM.
3. Apply for access. If you run a security team, evaluate the Cyber Verification Program and comparable programs from other model providers.
4. Scan yourself. Capable open-weight and commercial models can run agentic review against your first-party code today.
5. Give back. Report what you find upstream, fund maintainers of your critical dependencies, and contribute fixes, not just bug reports.
6. Close the identity gap yourself. No consortium is solving machine identity for you. Chapter 5 is your plan.
7. Join a sharing community. Sector ISACs and peer groups give you earlier warning than public advisories.

Key takeaways

• Glasswing showed that AI-scale discovery works, and that fixing is now the constraint.
• The October shift to a tiered Cyber Verification Program widened defender access while keeping guardrails.
• The open problems are remediation funding, verification transparency, agent identity standards and access for smaller organizations.
• The next phase of collaborative defense is about coordination and fixing, not finding.
• Non-members benefit most by patching fast, scanning their own code and governing their own identities.

Tools and programs are two legs of defense. The third is people. Chapter 8 covers how to build a team that can operate at this speed.