Anthropic announced Project Glasswing on 7 April 2026. Partners use its unreleased model, Claude Mythos Preview, to find and fix software flaws, and Anthropic says it has found thousands of high-severity vulnerabilities. For site owners, the practical point is faster patching of the software the website runs on.
What are Mythos, Daybreak and Glasswing?
Project Glasswing is an initiative Anthropic announced on 7 April 2026 to help secure widely used software, according to Anthropic’s Project Glasswing page. Partners use Claude Mythos Preview, an unreleased Anthropic AI model, for defensive security work. Anthropic says only the most skilled human experts can match the model at finding software flaws and exploiting them.
Key facts from Anthropic’s own pages:
| Item | What Anthropic states |
|---|---|
| Launch partners | Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks |
| Extra access | Over 40 more organisations that build or maintain critical software |
| Funding | Up to $100 million in usage credits and $4 million in donations to open-source security groups |
| Public availability | Anthropic does not plan to release Claude Mythos Preview generally |
OpenAI’s Daybreak is a separate programme. CoSA Lab does not describe it here, because OpenAI’s own pages could not be checked when this brief was written.
Does AI bug-hunting affect your site?
Yes, indirectly. Your site runs on software that other people maintain, and Anthropic reports that Claude Mythos Preview found flaws in each of the major operating systems and web browsers. It did not target small business sites as such.
Anthropic’s Claude Mythos Preview report gives examples that have since been fixed. They include a 27-year-old OpenBSD bug and a 16-year-old bug in FFmpeg, a video library. It also describes chained Linux kernel flaws that could take an attacker from ordinary access to full control of a machine.
The report is blunt about the catch. Anthropic wrote that over 99% of the vulnerabilities it found were not yet patched at the time, so most details are withheld while maintainers fix them. Disclosure can take up to 90 plus 45 days. Finding bugs is getting faster than fixing them.
Anthropic’s advice to software owners applies to a small business too:
- Shorten the time between a fix being released and you installing it.
- Turn on automatic updates where you safely can.
- Treat updates that fix security problems as urgent.
- Plan for software that no longer receives fixes.
Old plugins, themes and unsupported PHP versions are where that advice bites hardest, because they stop receiving fixes. For the attacker’s side, see how AI-powered attacks work.
What should you do this week?
Any small business website should take the four steps below. They match the advice in Anthropic’s report.
- Update your CMS, plugins and themes, and remove the ones you no longer use. WordPress security now that AI finds bugs faster gives the order.
- Check the PHP version your host runs and move off any version that no longer gets security fixes. How to check your PHP version shows how.
- Run the checklist in How to check your website for weak spots before AI attackers do.
- Read What is AI penetration testing, and do you need it? to decide whether an outside test is worth it for your site.
Common questions
Can I use Claude Mythos Preview on my own website?
Not at present. Anthropic says it has no plans for a general release of Claude Mythos Preview. Access is limited to Project Glasswing partners and other approved organisations.
Sources
- Anthropic: Project Glasswing(anthropic.com)
- Anthropic Frontier Red Team: Claude Mythos Preview(anthropic.com)
