Anthropic is scaling Project Glasswing, its AI-powered vulnerability discovery initiative, from an initial cohort of 50 partners to roughly 150 new organizations across 15 countries. The expansion targets critical infrastructure sectors—power, water, healthcare, communications, and hardware—that were underrepresented in the early pilot, which included the U.S. government.

At the system’s core is Claude Mythos, Anthropic’s most capable model for static analysis. According to the company, Mythos can identify thousands of zero-day vulnerabilities over several weeks by scanning codebases at scale. The architecture relies on a combination of context-aware pattern matching and automated fuzzing pipelines, with results triaged by severity before human review.

From an engineering standpoint, the key challenge here is false positive management. Running a model this aggressive across heterogeneous codebases—from embedded firmware to cloud-native microservices—requires careful tuning of confidence thresholds and per-repo baselines. Anthropic hasn’t disclosed recall or precision metrics, but the expanded rollout suggests they’ve achieved acceptable rates for production use.

New partners include Okta, Samsung, SK Hynix, SK Telecom, NATO, and the EU’s cybersecurity agency ENISA. Geographically, the list skews toward U.S.-aligned nations: Australia, Canada, France, Germany, India, Japan, South Korea, and several European countries. The company estimates a successful attack on any of these codebases could affect over 100 million people.

Anthropic acknowledges that rival models—like OpenAI’s recently released GPT-5.5-Cyber—will soon match Mythos’s capability. Their strategy is to establish trust and integration patterns now, before the market commoditizes. For data and ML engineers, the takeaway is clear: LLM-based security tooling is moving from research demos to production pipelines, and the infrastructure to support it—CI/CD hooks, secure sandboxing, and audit trails—needs to mature fast.

Source: TechCrunch