The company also launched Project Glasswing and gave Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks, and other partners in the open source community access to the LLM, to help them secure critical software before AI systems can be used to target it.<\/p>\n
Since then, with Mythos\u2019 help, several companies, including Cloudflare<\/a> and Mozilla<\/a>, have discovered hundreds of vulnerabilities in their codebases.<\/p>\n Anthropic has also scanned more than 1,000 open-source projects with Mythos, and has identified 23,019 issues, of which 6,202 were high- or critical-severity vulnerabilities. <\/p>\n The company and six independent security research firms have assessed 1,752 of those high- or critical-severity findings, and more than 90% were validated as true positives, the company added.<\/p>\n Anthropic\u2019s dashboard of open-source vulnerabilities, showing vulnerabilities of all severities<\/p>\n Patching becomes the bottleneck<\/p>\n More disclosures of vulnerabilities unearthed with Mythos\u2019 help are yet to come, as the project was started just a couple of months ago and the coordinated vulnerability disclosure process typically takes time. (Newly discovered flaws are kept private, usually for 90 days or until patches are available, before being made public.)<\/p>\n For example, Mythos identified a vulnerability in wolfSSL, an open-source cryptography library used by billions of devices, and constructed an exploit that would let an attacker forge certificates that would allow them to host a fake website for a bank or email provider. The vulnerability has been patched, but technical details are still under wraps.<\/p>\n Anthropic says that even though they made sure to deliver detailed vulnerability reports to open source maintainers, the latter have become a major bottleneck in the AI-driven vulnerability discovery process.<\/p>\n \u201cThe relative ease of finding vulnerabilities compared with the difficulty of fixing them amounts to a major challenge for cybersecurity,\u201d the company said<\/a>.<\/p>\n Plans for the future<\/p>\n To help open source maintainers process and triage bug reports, Anthropic partnered with the Open Source Security Foundation\u2019s Alpha-Omega<\/a> project.<\/p>\n![\"Project](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/05\/Anthropic-Project_Glasswing_update.webp\" "\\"Anthropic\u2019s")
<\/p>\n