Project Glasswing: When AI Finds Vulnerabilities Faster Than We Can Fix Them

Last week, Anthropic announced Project Glasswing – an AI model so effective at discovering software vulnerabilities that the company took the extraordinary step of postponing its public release. Instead, Anthropic granted early access to Apple, Microsoft, Google, Amazon, and a coalition of other tech giants to find and patch bugs before adversaries could exploit them.

The model behind Glasswing, called Mythos Preview, found vulnerabilities across every major operating system and browser. Some of these bugs had survived decades of human audits, aggressive fuzzing, and open‑source scrutiny. One had been sitting for 27 years in OpenBSD, widely considered one of the world’s most secure operating systems.

It’s tempting to dismiss this as “AI lab says its AI is too dangerous” – the same playbook OpenAI ran with GPT‑2. But this time, there’s a material difference. Mythos didn’t just find individual CVEs. It:

Chained four independent bugs into an exploit sequence that bypassed both the browser renderer and OS sandboxing
Performed local privilege escalation in Linux through race conditions
Built a 20‑gadget ROP chain targeting FreeBSD’s NFS server, distributed across packets

Anthropic’s previous frontier model, Claude Opus 4.6, failed almost entirely at autonomous exploit development. Mythos achieved a 72.4% success rate in the Firefox JS shell. This isn’t theoretical, nor a three‑to‑five‑year prediction. It is about to be a real‑world engineering reality.

Why Project Glasswing Exposes the Real Cybersecurity Gap

Here’s the number that should keep security leaders awake at night: fewer than 1% of the vulnerabilities found by Mythos were patched.

Let that sink in. The most powerful vulnerability discovery engine ever built ran against the world’s most critical software – and the ecosystem couldn’t absorb the output. Glasswing solved the finding problem. Nobody solved the problem of fixing.

Why Defenders Can’t Keep Up: Calendar Speed vs. Machine Speed

This is the structural issue the cybersecurity industry has circled for years. AI just made it impossible to ignore.

Defenders operate on calendar speed: gather intelligence → build a campaign → simulate threats → mitigate → repeat. That cycle takes about four days on a good day. Attackers, especially those now leveraging LLMs at every stage of their operation, are moving at machine speed.

AI‑Powered Attacks Are Already Autonomous

Earlier this year, a threat actor deployed a custom MCP server hosting an LLM as part of their attack chain against FortiGate appliances. The AI handled everything: automated backdoor creation, internal infrastructure mapping fed directly to the model, autonomous vulnerability assessment, and AI‑prioritized execution of offensive tools for domain admin access. The result? 2,516 organizations across 106 countries were compromised in parallel. The entire chain – from initial access through credential dumping to data exfiltration – was autonomous. Human involvement only came afterward to review results.

AI‑Based Vulnerability Discovery Is Outpacing Remediation

The gap between attacker speed and defender speed isn’t new. What’s new is that a small, worrisome gap just became a canyon.

Autonomous systems like AISLE discovered 13 out of 14 OpenSSL CVEs in recent coordinated releases – bugs that survived years of human review.
XBOW became the top‑ranked hacker on HackerOne in 2025, surpassing all human participants.
The median time from disclosure to weaponized exploit dropped from 771 days in 2018 to single‑digit hours by 2024.
By 2025, the majority of exploits are weaponized before public disclosure.

Now add Mythos‑class discovery to this picture. You don’t automatically get a safer world. You get a tsunami of legitimate findings that still require human verification, organizational process, business continuity considerations, and patch cycles that haven’t fundamentally changed in a decade.

How to Build a Mythos‑Ready Security Program

The instinct after Glasswing is to ask: “How do we find more bugs?” That’s the wrong question. The right one is: “When thousands of exploitable vulnerabilities land on your desk tomorrow morning, can your program actually process them?”

For most organizations, the honest answer is no. The reason isn’t a lack of tools or talent – it’s a structural dependency on periodic, human‑initiated processes designed for a world where vulnerabilities trickled in, not one where they arrive in a tsunami.

We can’t fix every vulnerability. We can’t apply every hardening option. That’s not defeatism; it’s the pragmatic starting point for any security program that actually works. The question that matters isn’t “Is this CVE critical?” but “Is this vulnerability exploitable in my environment, right now, given what I have deployed?”

A Mythos‑ready security program needs three fundamental pieces:

Signal‑driven validation over scheduled testing – When a new threat emerges, when an asset changes, or when configuration drifts, defenses need to be tested against that specific change in that moment. Not during the next quarterly pentest. Scheduled validation assumes a stable threat landscape – an assumption that is dead on arrival.
Environment‑specific context over generic CVSS scores – Glasswing will produce an avalanche of CVEs. Most vulnerability management programs still prioritize by CVSS scores – a context‑free metric that tells you how bad a bug could be in theory, not whether it’s exploitable in your specific infrastructure. When findings go from hundreds to thousands, context‑free prioritization will break your process.
Closed‑loop remediation without manual handoff – The current model (scanner finds bug → analyst triages → ticket goes to another team → someone patches weeks later → nobody re‑validates) cannot survive when adversaries exploit CVEs within hours of disclosure. If the cycle from finding to fix to re‑validation can’t run without humans shuttling tickets between queues, it isn’t running anywhere near machine speed.

How Autonomous Exposure Validation Closes the Gap

This is where I need to be transparent: I’m writing from the perspective of Picus Security, where we build a platform for Autonomous Exposure Validation. Consider my bias accordingly.

What Glasswing crystallized is that the validation step within any exposure management program just became the most critical bottleneck. Finding vulnerabilities is about to get radically easier and more efficient. Patching them will remain painfully slow. The only lever you can pull in between is knowing which findings actually matter to your environment. That’s validation.

Picus built Picus Swarm – an AI team of agents that work together to do what used to require handoffs between four separate teams:

A researcher agent ingests and vets threat intelligence.
A red teamer agent maps it against your environment to generate a safety‑checked attacker playbook.
A simulator agent executes across your actual endpoints and cloud, gathering telemetry and proof data.
A coordinator agent bridges findings to remediation – opening tickets, triggering SOAR playbooks, pushing indicators of attack to your EDR, and re‑validating after fixes land.

Every action is traceable and auditable. Every agent operates within guardrails you define. The entire chain – from a new CISA alert to validated, remediation‑ready findings – runs in about three minutes. When a Mythos‑class model drops thousands of findings on your organization, you need something that can immediately tell you which are exploitable in your environment, which controls would hold or fail, and what the vendor‑specific fix is.

The Uncomfortable Truth

Project Glasswing will be measured by one metric: how many vulnerabilities get patched before they are exploited. Not how many are found. Not how impressive the exploit chains are. But whether the ecosystem can digest what AI is about to produce.

Visibility alone has never been enough – 83% of cybersecurity programs still show no measurable results. What changes the equation is closing the gap between seeing and proving: knowing whether a potential vulnerability would actually compromise your environment.

That’s validation. And in a post‑Glasswing world, it’s the only thing standing between a flood of discoveries and a flood of breaches.