subscribe
TotalNews Logo

CHOOSE LANGUAGE

SELECT LANGUAGE BELOW

Subscribe
TotalNews Logo

Project Glasswing: Protecting essential software for the age of AI

Project Glasswing: Protecting essential software for the age of AI

Identifying vulnerabilities and exploits with Claude Mythos Preview

Recently, Claude Mythos Preview has been instrumental in uncovering numerous zero-day vulnerabilities—those previously unknown to developers—across major operating systems, web browsers, and other vital software. Some of these vulnerabilities are quite serious.

In our post, specifics regarding a selection of patched vulnerabilities are discussed, including methods to potentially exploit some identified by Mythos Preview. Notably, this process of identifying and developing exploits for many of the vulnerabilities was carried out entirely automatically, without human involvement. Here are three noteworthy examples.

  • Mythos Preview identified a vulnerability dating back 27 years in OpenBSD, renowned as one of the most secure operating systems, commonly used for firewalls and critical infrastructure. This flaw enables remote crashes just by connecting to the system running OpenBSD.
  • A 16-year-old vulnerability in FFmpeg, which plays a key role in video encoding and decoding for various applications, was also found. It lay hidden in a code segment that automated testing tools overlooked, even after five million tests.
  • This model autonomously linked several vulnerabilities within the Linux kernel, a core component that supports most of the world’s servers, allowing attackers to elevate their access from a normal user level to complete machine control.

These vulnerabilities have been reported to the appropriate software administrators, and fixes have been implemented. For additional vulnerabilities, we are providing cryptographic hashes of their details today (see Red Team blog) and will share further specifics once the necessary fixes are in place.

Evaluation benchmarks like CyberGym reveal marked distinctions between Mythos Preview and the next leading model, Claude Opus 4.6.

Reproducing cybersecurity vulnerabilities

Alongside our own findings, many partners have been exploring Claude Mythos Preview for several weeks. Their results are noteworthy:

“AI capabilities have crossed a threshold that fundamentally changes the urgency needed to protect critical infrastructure from cyber threats, and there is no going back. We have found that our foundational work with these models allows us to identify and remediate security vulnerabilities across hardware and software at a pace and scale that was previously impossible. This is a sea change, and a clear signal that traditional methods of hardening systems are no longer sufficient.”Providers now need to be willing to adopt new approaches, and customers need to be ready to adopt them, too. This is why Cisco joined the project.

“At AWS, we build defenses before threats emerge, from our custom silicon to our technology stack. Security is not a phase for us; it is continuous and embedded in everything we do. Our teams analyze over 400 trillion network flows to detect threats every day, and AI is at the heart of our ability to defend at scale. We use Claude Mythos Preview in our own security operations. We are bringing our security expertise to our partnership with Anthropic to help power Claude Mythos Preview, so even more organizations can move forward with their most ambitious work with standard-setting security.”

“As we enter a phase where cybersecurity is no longer tied to purely human capabilities, the opportunity to responsibly use AI to improve security and reduce risk at scale is unprecedented. By joining Project Glasswing with access to Claude Mythos Preview, you can identify and mitigate risks early and enhance your security and development solutions, so you can better protect your customers and Microsoft.”

Igor Tsygansky

Vice President, Cybersecurity and Microsoft Research, Microsoft

“The window between a vulnerability being discovered and being exploited by an adversary has collapsed. What once took months can now be done in minutes with AI. The Claude Mythos Preview demonstrates what defenders can do at scale, and adversaries will inevitably seek to exploit the same capabilities. That’s not a reason to slow down. It’s a reason to work together and move faster. AI needs security for deployment, which is why CrowdStrike has been part of this effort since day one.”

“Traditionally, security expertise has been a luxury reserved for organizations with large security teams. Maintainers of open source, whose software underpins much of the world’s critical infrastructure, have historically been forced to figure out security themselves. Open source software comprises much of modern code, including systems that AI uses to generate new software. By giving code maintainers access to a new generation of AI models that can proactively identify and remedy vulnerabilities at large scale, Project Glasswing provides a valuable solution, making AI-enhanced security a trusted resource for all maintainers, not just costly security teams.”

“Advancing cybersecurity and resiliency in the financial system is central to JPMorgan Chase’s mission, and we believe the industry is strongest when industry-leading institutions collaborate on a common challenge. We take a rigorous, independent approach to determining our direction and how we can contribute. Anthropic’s initiatives reflect a collaborative and forward-thinking approach that this moment requires.”

Pat Oppet

JPMorgan Chase Chief Information Security Officer

“Google is pleased to see this cross-industry cybersecurity initiative working together and making Mythos Preview available to participants through Vertex AI. It has always been essential for the industry to collaborate on emerging security issues, including post-quantum cryptography, responsible zero-day disclosure, secure open-source software, and defending against AI-based attacks.”

“For the past few weeks, we have been using the Claude Mythos Preview. We now have access to models that have helped us discover complex vulnerabilities that previous models completely missed. This is revolutionary for identifying hidden vulnerabilities and enabling quicker creation of zero-day vulnerabilities. As attacks evolve, cybersecurity measures must also advance. We commend Anthropic for prioritizing these powerful features for defense.”

The impressive capabilities of Claude Mythos Preview stem from its effective coding and reasoning skills. Evaluation results indicate that this model scores higher than any other developed thus far on various software coding tasks.

Mythos preview without tools
Mythos preview using tools

For more on the model’s functionality, safety, and characteristics, please refer to the following pages: Claude Mythos Preview System Card.

While there are no plans to make Claude Mythos Preview publicly available, the ultimate aim is to enable safe, large-scale deployment of Mythos class models, not just for cybersecurity, but for a range of other beneficial applications. This involves enhancing cybersecurity measures and other safeguards to identify and prevent the most dangerous model outputs. Future Claude Opus models will include improved protections, refining measures for models not posing the same risks as the Mythos Preview.

Project Glasswing Plan

This announcement marks the start of a long-term initiative. Achieving success requires extensive collaboration within and outside the tech industry.

Partners in Project Glasswing will access Claude Mythos Preview to help locate and address vulnerabilities in systems, covering a significant portion of the global cyber attack surface. The focus will include local vulnerability detection, binary black box testing, endpoint protection, and system penetration testing.

Anthropic is committing $100 million in model usage credits to Project Glasswing and additional participants to support extensive use during this research preview. The Claude Mythos Preview will later be made available to participants at $25 or $125 per million input/output tokens (participants will use the Claude API, Amazon Bedrock, Google Cloud’s Vertex AI, and models on Microsoft Foundry).

In addition to the model usage credits, we donated $2.5 million to Alpha-Omega and OpenSSF through the Linux Foundation and $1.5 million to the Apache Software Foundation to help open-source maintainers adapt to this evolving landscape.

We plan to broaden this effort and continue for several months, sharing insights to help other organizations apply these lessons to their security. Partners will exchange information and best practices as possible. Within 90 days, Anthropic will publicly report what we’ve learned, including any fixed vulnerabilities or improvements that can be disclosed. Additionally, we will collaborate with key security organizations to formulate practical recommendations on how security practices should adapt in the era of AI, which may involve:

  • Vulnerability disclosure process.
  • Software update process.
  • Open source and supply chain security.
  • Software development lifecycle and secure by design practices.
  • Regulated industry standards.
  • Prioritize scaling and automation.
  • Automate patching.

Anthropic is also in ongoing discussions with U.S. government officials regarding the Claude Mythos Preview and its cyber capabilities. Ensuring the protection of critical infrastructure is a significant national security priority for democracies. These burgeoning cyber capabilities further emphasize the need for the U.S. and its allies to maintain leadership in AI technology, with government involvement crucial for assessing and alleviating risks associated with AI models. We are prepared to collaborate with local, state, and federal representatives to support these initiatives.

We aim for Project Glasswing to serve as a foundation for broader efforts across the industry and public sector, aiding all stakeholders in addressing major security questions relating to robust models. We encourage other AI industry members to help establish industry standards. In the medium term, independent third parties that can unites private and public entities may be ideal for continued large-scale cybersecurity projects.

Facebook
Twitter
LinkedIn
Reddit
Telegram
WhatsApp

Related News