Project Glasswing

Anthropic's controlled-access program giving vetted partners early defensive access to Mythos before broad availability — the flagship case of restrict-vs-release model governance.

Also known as: Project Glasswing, project glasswing

Part of: Mythos

How authors use it

Oldest first (extraction date when no publication date is known).

Documents (7)

• IBM and Red Hat Commit $5 Billion to Redefine the Future of Open Source in the AI Era IBM Newsroom · 2026-05-28 source ↗ Reader 🖥️
  IBM and Red Hat are announcing — without yet demonstrating — that a $5 billion, AI-augmented, 20,000-engineer commercial clearinghouse (Project Lightwell) is the model enterprises should adopt to secure their open-source software supply chain against AI-accelerated vulnerability discovery.
• This Week in AI: Rethinking the Agent Harness Michelle Smith · 2026-05-22 source ↗ Reader 🖥️
  In mid-2026 the strategic locus of AI value has shifted from model selection to harness design, so practitioners — including non-developers — should build their own skill-driven agent harnesses rather than depend on bespoke applications or wrapped commercial products.
• Project Glasswing: what Mythos showed us Grant Bourzikas · 2026-05-18 source ↗ Reader 🖥️
  Frontier security-focused LLMs (exemplified by Mythos Preview) have made a real qualitative jump in exploit-chain construction and proof generation, but their value at production scale is unlocked not by faster patching or smarter single-agent use, but by wrapping them in a multi-stage harness of narrow, parallel, adversarially-validated agents and by hardening the architecture around vulnerabilities so that the gap between disclosure and patch matters less.
• The Trump administration's AI doomer moment Casey Newton · 2026-05-05 source ↗ Reader 🖥️
  The Trump administration, having spent over a year dismissing AI safety concerns as fearmongering and regulatory capture, has been forced by the demonstrable national-security risks of Anthropic's Mythos model to quietly revive the very pre-release government review regime it mocked and dismantled under Biden — revealing that accelerationist AI policy collapses when confronted with actual frontier-model capabilities.
• Radar Trends to Watch: May 2026 Mike Loukides and Claude · 2026-04-20 Reader 🖥️
  The AI industry is rapidly moving from experimental models to operational infrastructure — agents, orchestration layers, and security tooling — and the central tension is between open deployment and controlled access, a tension most visible in the divergent approaches to frontier security capabilities taken by Anthropic (restrict) and OpenAI (release).
• Meta's new model is Muse Spark, and meta.ai chat has interesting new tools Simon Willison · 2026-04-10 source ↗ Reader 🖥️
  The AI frontier is advancing simultaneously on two fronts — model capability (Meta's Muse Spark, Z.ai's GLM-5.1) and model danger (Anthropic's Mythos finding decades-old vulnerabilities at scale) — and the industry's response to both fronts reveals how the relationship between open and closed AI is being renegotiated under pressure from security realities.
• Assessing Claude Mythos Preview's cybersecurity capabilities Nicholas Carlini, Newton Cheng, Keane Lucas, Michael Moore, Milad Nasr, et al. (Anthropic) · 2026-04-08 source ↗ Reader 🖥️
  Claude Mythos Preview represents a qualitative leap in autonomous vulnerability discovery and exploitation — finding and exploiting zero-days in every major OS and browser, including bugs that survived decades of human auditing — and the security industry must begin urgent coordinated defense now, during the transitional period before these capabilities become broadly available, because the same general improvements in reasoning and autonomy that make models better at fixing vulnerabilities make them equally better at exploiting them.

Propositions touching this concept (2)

By publication month, oldest first (extraction month when no publication date is known).

2026-05

• explicitcontestedAnthropic withholding Mythos via Project Glasswing is not a security mechanism — a swarm of five 1.2B-parameter models on a MacBook can already find similar zero-days; vendor self-restraint is structurally insufficient and unsustainable in a competitive market.
  16) Inga Strümke om hvor AI er på vei, den outsourcede problemløsningen og datamanifolden · p15

2026-08

• explicitcontestedAnthropic's Mythos/Project Glasswing capability was hyped beyond its actual novelty: the same flagship vulnerabilities it surfaced were also found by smaller, cheaper models, and the system looked weak specifically at converting a found vulnerability into a stealthy, working exploit -- an incremental advance, not a discontinuous one.
  Podcast: Will Agentic AI Bring Fantasia's Sorcerer's Apprentice to Life?: A Conversation with Tracy Bannon · p10

Open gaps (29)

• incompleteThe paper doesn't discuss the implications for memory-safe language migration strategies. If the remaining vulnerability surface is increasingly in unsafe blocks (as the VMM case shows), does the industry need to rethink how unsafe code is audited, isolated, and minimized? The 'just rewrite in Rust' narrative needs updating given that Rust's unsafe blocks are now a primary target.
  Assessing Claude Mythos Preview's cybersecurity capabilities — read next: Rust safety literature; formal verification of unsafe blocks; the 'unsafe Rust' audit ecosystem
• incompleteThe cost figures ($20,000 for OpenBSD, $10,000 for FFmpeg) imply that nation-state actors — or well-funded criminal organizations — could run comprehensive vulnerability scans against all critical infrastructure software for less than the cost of a single human security researcher's annual salary. The geopolitical implications of this cost structure are not discussed.
  Assessing Claude Mythos Preview's cybersecurity capabilities — read next: Norwegian intelligence assessments (PST, NSM) on cyber threats; the economics of cyber offense vs. defense at national scale
• incompleteThe article does not address whether Meta's shift from open weights to closed hosting is driven by competitive pressure, safety concerns, or compute economics. The 10x efficiency claim is stated but not analyzed — if frontier performance is achievable with 10x less compute, that should make open-weight releases more feasible, not less.
  Meta's new model is Muse Spark, and meta.ai chat has interesting new tools — read next: Meta's AI strategy documents; analysis of the economics of open-weight vs. API-hosted model distribution
• incompleteThe Glasswing section does not address the offensive/defensive asymmetry: Anthropic gives defenders a head start, but the underlying capabilities will inevitably proliferate. How long is the defensive window, and what happens when it closes?
  Meta's new model is Muse Spark, and meta.ai chat has interesting new tools — read next: Thomas Ptacek's 'Vulnerability Research Is Cooked'; cybersecurity literature on offense-defense balance with new capability categories
• incompleteThe article treats the Axios social engineering attack and the AI vulnerability discovery trend as separate stories, but does not connect them: AI could make social engineering attacks on maintainers more scalable and convincing, compounding both threats simultaneously.
  Meta's new model is Muse Spark, and meta.ai chat has interesting new tools — read next: Research on AI-enhanced social engineering; analysis of combined technical+social attack vectors
• incompleteThe GitHub activity statistics (275M commits/week, 2.1B Actions minutes/week) are presented without analysis of how much is AI-generated. If a significant fraction is AI-driven, these numbers may indicate code volume inflation rather than genuine productivity gains.
  Meta's new model is Muse Spark, and meta.ai chat has interesting new tools — read next: GitHub's own analysis of Copilot-attributed commits; research on whether AI-generated code volume correlates with software quality
• incompleteThe article presents the three-layer agentic stack (orchestration, execution, review) as an emerging standard but provides no analysis of whether this architecture is actually sound or just the first thing that crystallized. There is no discussion of failure modes, debugging, or accountability within this architecture.
  Radar Trends to Watch: May 2026 — read next: Bryan Cantrill's laziness essay; 'Hidden Technical Debt of Agentic Engineering'; distributed systems architecture literature
• incompleteThe tension between 'reimagining' (rebuilding software from scratch with AI) and 'laziness' (the virtue of designing for future maintainability) is present in the article but never connected. If AI makes building cheap but maintaining thoughtful, these two trends are on a collision course.
  Radar Trends to Watch: May 2026 — read next: Cantrill's full essay on laziness; the original 'Hidden Technical Debt in Machine Learning Systems' paper
• uninformedThe article does not address the labor market implications of AI becoming operational at the team level. If agents replace team-level workflows, the impact on employment is qualitatively different from individual productivity gains.
  Radar Trends to Watch: May 2026 — read next: Daron Acemoglu's work on AI and labor; the Stanford AI Index's labor market sections
• incompleteThe co-authorship attribution ('Mike Loukides and Claude') is noted without comment. The article does not discuss what it means for a trends roundup to be co-authored by an AI model — raising questions about editorial judgment, selection bias, and the epistemic status of the analysis.
  Radar Trends to Watch: May 2026 — read next: Discussions of AI co-authorship norms; editorial standards for AI-assisted journalism
• incompleteThe 'rethinking' is asserted rather than performed. The article never enumerates the prior harness assumptions being overturned (e.g., DAG-based orchestration, deterministic tool dispatch, code-defined skills, developer-mediated change) nor articulates the new principles replacing them beyond 'skills written in English.' For a piece titled 'Rethinking the Agent Harness,' the actual rethink is one anecdote and one neologism.
  This Week in AI: Rethinking the Agent Harness — read next: Berryman & Ziegler, 'Prompt Engineering for LLMs' (the cited O'Reilly book); Anthropic's own Claude Code design docs; the Stanford paper at arXiv:2603.28052; Birgitta Böckeler's 'harness engineering' piece for an attempt to actually decompose the harness layer.
• incompleteSingle-case generalization. The unity ('build your own harness') rests almost entirely on one consulting client where it 'worked perfectly.' No failure modes, no boundary conditions, no comparison to cases where a bespoke app or a wrapped product would still be the right choice.
  This Week in AI: Rethinking the Agent Harness — read next: Post-mortems of agent deployments at scale; the Cognition/Devin retrospectives; harness-engineering writeups from teams shipping to production rather than consultants.
• incompleteThe relationship between the three sections is unargued. Mythos, the compute buildout, and the harness thesis are juxtaposed without the article noticing that they imply different theories of where AI value is moving — model layer (compute), capability frontier (Mythos), or harness layer (Berryman). The implicit reconciliation would be the most interesting move and isn't made.
  This Week in AI: Rethinking the Agent Harness — read next: Articles framing 'value migration in the AI stack' explicitly; investor letters or analyst notes that try to resolve which layer captures economic returns.
• incompleteThe 'open agent protocol' is named without being specified. No design sketch, no examples of what an environment-supplied skill looks like, no comparison to existing proposals (MCP, A2A, agent-to-agent protocols). The reader is left with a direction but no testable proposal.
  This Week in AI: Rethinking the Agent Harness — read next: Anthropic's Model Context Protocol spec; agent interoperability proposals from Google, OpenAI, and the LangChain ecosystem; the future-cast section in the next Berryman appearance.
• uninformedSchneier's challenge to Mythos's uniqueness is mentioned and then immediately set aside ('either way, it's a problem that's coming'). The article does not engage with the substantive question of whether the policy response is calibrated to actual differential capability or to perceived capability — a question whose answer matters for whether FDA-style review is wise.
  This Week in AI: Rethinking the Agent Harness — read next: Schneier's full post on Mythos; CAISI's framing; counter-arguments from researchers who replicated Mythos-like findings on cheaper public models.
• illogicalMild equivocation on 'harness.' Claude Code (a specific product), 'the agent harness' (a layer), and Berryman's bespoke consulting build (a specific instance) are used interchangeably. A reader could leave thinking 'use Claude Code' and 'build your own harness' are the same recommendation, when the article's argument actually requires the latter and only points at the former as an example.
  This Week in AI: Rethinking the Agent Harness — read next: Explicit harness taxonomy work — what distinguishes a product, a framework, and a bespoke harness — e.g., Böckeler's 'harness engineering' piece.
• incompleteNo base rate or comparison to non-LLM SAST/DAST. The post claims Mythos produces 'noticeably higher quality' triage output and that the harness produces 'meaningful coverage', but provides no quantitative baseline against either prior frontier models or traditional static analysis. The reader has to take Cloudflare's qualitative judgment on faith.
  Project Glasswing: what Mythos showed us — read next: Read the Anthropic harness paper (planner/generator/evaluator) and any forthcoming Mythos technical report for quantified eval data; cross-reference with industry SAST benchmarks (e.g. OWASP Benchmark) to triangulate.
• incompleteVendor-incentive analysis is absent. Cloudflare was an invited Glasswing partner and benefits from being perceived as an Anthropic-grade security research org. The post is simultaneously a research report, a co-marketing artifact, and a strategic positioning piece for Cloudflare's edge product suite ('our products are built to apply [these principles] on behalf of customers'). None of this is acknowledged.
  Project Glasswing: what Mythos showed us — read next: Read Schneier on Security or Marcus on AI safety for an external skeptic's read; look for independent reproductions of Cloudflare's claims by orgs without an Anthropic partnership.
• incompleteNo adversarial robustness data. If attackers know LLM-based scanners are in the loop, they can seed code with patterns that exploit known model biases — false-negative attractors, hedging triggers, or refusal-inducing framings on the defender's side. The post discusses defender adversariality (adversarial review between agents) but not attacker adversariality.
  Project Glasswing: what Mythos showed us — read next: Anthropic's own work on adversarial robustness; the broader literature on prompt injection and indirect prompt injection in agentic systems.
• incompleteGeneralizability across stacks is asserted by silence. Cloudflare's codebase — heavily Rust, well-documented, with explicit trust boundaries and the discipline that comes from running a global edge network — is unusually well-suited to the harness as described. Whether the same harness pays off on a typical enterprise Java monorepo with sparse documentation and ambiguous trust boundaries is an open empirical question.
  Project Glasswing: what Mythos showed us — read next: Look for similar reports from non-Cloudflare practitioners (Google Project Zero, Microsoft, GitHub Advanced Security with Copilot Autofix at scale) using comparable harness architectures; pair with Böckeler on variety reduction as the precondition for any harness to work.
• incompleteThe 'context anxiety / compaction discards earlier findings' claim is offered as a one-line motivation for the harness but is the most theoretically interesting failure mode in the post — and the one that connects most directly to the user's harness-engineering reading thread. Bourzikas leaves the mechanism opaque (how often does compaction discard a real finding? does Mythos behave differently from general frontier models on this dimension?).
  Project Glasswing: what Mythos showed us — read next: Re-read the Anthropic harness paper's 'context anxiety' discussion; pair with Böckeler's variety-reduction framing and the smallcode failure-mode catalog; consider an extraction comparing the three on a single axis: 'what is the model's relationship to its own context, and what does the harness do about it?'
• incompleteThe model-written-patches anecdote is mentioned in one sentence and then abandoned. How many patches went out? How were the regressions detected — by Cloudflare's own pipeline or by customer impact? What was rolled back? Given that this is a public commitment that Cloudflare shipped broken patches authored by an LLM, the lack of detail is itself a finding.
  Project Glasswing: what Mythos showed us — read next: Watch for follow-up Cloudflare posts; pair with research on LLM-generated patch quality (e.g. recent academic work on Copilot Autofix regression rates).
• illogicalThe two-hour SLA argument elides a continuum. Bourzikas treats 'two-hour SLA' as the strawman and 'architectural hardening' as the alternative, but the realistic question is whether to push patch-speed to four hours, twelve hours, or 24 hours while also investing in architecture. The dichotomy is rhetorically convenient and conveniently routes attention toward Cloudflare's product moat.
  Project Glasswing: what Mythos showed us — read next: Read existing CVE-to-patch SLA literature (e.g. industry reports on time-to-remediate) to understand the actual distribution; question whether Cloudflare's customers are the ones being warned-off the two-hour target.
• uninformed (potentially)No engagement with formal-methods or non-LLM approaches to reachability analysis (the 'Trace' stage's job). Static analyzers, taint trackers, and symbolic execution engines have been doing reachability for decades; the post implicitly treats LLM tracer agents as a novel solution without engaging with what they replace.
  Project Glasswing: what Mythos showed us — read next: Compare against CodeQL, Semgrep, and formal taint-tracking literature; ask whether LLM tracer agents complement or substitute for these.
• unasked questionNo discussion of whether other frontier models (from Google, OpenAI, xAI) have similar capabilities — the narrative is anchored entirely on Anthropic/Mythos, suggesting the policy shift may be broader than one model.
  The Trump administration's AI doomer moment — read next: Comparative assessments of frontier model capabilities across labs; government red-team evaluations.
• unasked questionThe piece does not explore whether the 'supply chain risk' designation against Anthropic was legally sound or politically motivated beyond noting the Pentagon contract dispute.
  The Trump administration's AI doomer moment — read next: Legal analysis of the supply chain risk designation framework and its application to AI companies.
• scope limitationNo analysis of how foreign governments (China, Russia) are responding to these same capability thresholds — the national security framing is entirely domestic.
  The Trump administration's AI doomer moment — read next: International AI governance developments; Chinese AI regulation and military AI capabilities research.
• implicit premiseThe article assumes the pre-release review mechanism will function effectively but does not examine the Commerce Department's actual capacity to evaluate frontier models — a critical institutional capacity question.
  The Trump administration's AI doomer moment — read next: NIST/Commerce Department AI evaluation capabilities; UK AISI's experience with model evaluation.
• tensionCasey Newton discloses that his fiancee works at Anthropic but does not explore how this shapes the article's Anthropic-centric framing — the piece treats Anthropic as the protagonist of the policy reversal.
  The Trump administration's AI doomer moment — read next: Coverage of the same events from non-Anthropic-adjacent journalists for comparison.