Anthropic and 50 partners find over 10,000 serious bugs in a month

Anthropic's Project Glasswing, launched a month ago, has found over 10,000 high-risk and critical bugs in key software with about 50 partners. Using the Claude Mythos Preview model, some teams found bugs 10 times faster. Now, the main challenge is verifying and fixing them, not finding them.

Cloudflare found 2,000 bugs in its core systems, with 400 being high-risk or critical, and fewer false alarms than manual testing. Mozilla fixed 271 bugs in Firefox 150, ten times more than before. The Mythos Preview model also impressed in tests—UK's AI Security Institute said it was the first to break two cyber defense targets end-to-end.

For open-source software, Anthropic scanned over 1,000 projects, finding 23,019 bugs, with 6,202 considered high-risk or critical. After human checks, 90.6% were real bugs, and 62.4% were confirmed as high-risk or critical. But fixing them is tough—it takes about two weeks on average, and some open-source maintainers are struggling to keep up.