Project Glasswing: What Security Leaders Should Actually Do

Anthropic's Claude Mythos is restricted and commercially framed as a revolution in cyber defense. Here's what the announcement actually means and what leaders should do.

Apr 08, 2026

Is every day about to become a zero day?

Yesterday Anthropic announced something that doesn’t happen often in enterprise technology: a company unveiled its most powerful product and immediately said you can’t have it.

Anthropic claims that Claude Mythos Preview is, by every measurable benchmark, the most capable AI model Anthropic has ever built… and Anthropic explicitly stated it will not be made generally available due to cybersecurity risks.¹ Instead, access is restricted to roughly 40 organizations through a new initiative called Project Glasswing. The announcement has generated significant coverage, no small amount of hype, and partner quotes that start to paint a picture of where Claude Mythos fits into the industry’s approach to the broader AI threat landscape.

Here’s our take for CIOs, CTOs, and CISOs who need to know what [real] is, what’s amplified, and what to actually do starting today.

What’s real

Anthropic didn’t just make big claims—they appear to have backed them with real, verifiable results.

The 99% problem is the real story. At the time of announcement, fewer than 1% of the vulnerabilities found by Mythos had been patched.² Anthropic framed this as a responsible disclosure timeline issue. We’d frame it differently: a system that generates a disclosure queue faster than the industry can remediate it doesn’t automatically make you safer. It potentially creates new pressure for AI-assisted remediation tooling, which conveniently requires more API consumption.

The discovery bottleneck has never been the hard part of vulnerability management. The remediation bottleneck is.

In testing, the model was able to independently find and exploit serious vulnerabilities in widely used systems—some of them decades old and still undiscovered. In one case, it uncovered a flaw that could give an attacker full control of a system from anywhere on the internet without needing prior access.³

Mythos didn’t stop there. The model identified weaknesses in operating systems known for their strong security posture and even discovered a long-missed vulnerability in widely used media software that had escaped years of automated testing and human review.

The performance gap versus prior models is just as striking: where earlier systems could rarely produce working exploits, Mythos appears to have generated them at scale in the same environment.

This isn’t incremental progress. It’s a step change in capability. The underlying capability appears to be genuine, and it makes sense—adversaries have been using AI for reconnaissance, exploitation, and more for the past few years, including Anthropic’s own technology.⁴

What this may mean is that something materially different has arrived for the defender side: the most significant outcome of Anthropic’s Glasswing project is the acknowledgement of the current state and the all-of-industry escalation of the arms race. What AI companies used to try to prevent—exploitation tools developed by generative AI—they now are building to meet their basic needs.

What’s amplified — and why that matters

Here’s where the story gets more complicated, and where we’d encourage your leadership teams to pay close attention to how the announcement’s urgency framing positions the discussion on the capabilities.

The announcement was partially forced. In late March, a CMS misconfiguration left nearly 3,000 internal Anthropic documents publicly accessible, including details about Mythos. Security researchers found them; Fortune published them; cybersecurity stocks fell.⁵ Anthropic confirmed the leak and accelerated the official announcement.⁶ A launch shaped by a content management error is not the same as a carefully sequenced strategic disclosure and that context matters when you’re evaluating the urgency of the messaging.

The $100M in usage credits is not what it sounds like. After the credit pool is exhausted, Mythos Preview will be available to participants at $25/$125 per million input/output tokens.⁷ This is a well-established enterprise SaaS onboarding playbook: bring major organizations into a workflow dependency, then transition them to paid consumption. For organizations whose existing AI spend already runs into the millions annually, the credits are a functional discount and a customer acquisition mechanism — not charity.

The partner quotes warrant scrutiny

Glasswing partner quotes paint a picture of where Claude Mythos fits into the industry’s approach to the broader AI threat landscape.

Cisco’s statement that AI capabilities have “crossed a threshold” and that “old ways of hardening systems are no longer sufficient” is consistent with the technical evidence. Cisco has been broadly partnering rather than building its own generative AI security stack. Joining Glasswing is strategically useful for Cisco regardless of the technical merit of Claude Mythos.

AWS CISO Amy Herzog’s statement refers to analyzing “over 400 trillion network flows every day” and hints at “security that sets the standard” but the framing is generic enough and the chips-to-CTI angle is legitimate, but the quote doesn’t demonstrate deep Mythos-specific insight.

Microsoft’s Igor Tsyganskiy’s quote is among the more measured of the bunch, referencing Microsoft’s own CTI-REALM benchmark as a validation point, but it reads as much like an attempt to reassert Microsoft’s AI security credibility as it does a strong product endorsement for Claude Mythos.

The Linux Foundation’s Jim Zemlin makes perhaps the most substantive point: open source maintainers whose software underpins most of the world’s critical infrastructure have historically been left to figure out security on their own, and that Project Glasswing offers a credible path to changing that equation.⁸ That’s genuinely true, and it’s where the real defensive value of this initiative may lie — not in enterprise security stacks, but in the open-source dependency layer that underpins them.

The question that actually matters

Forbes raised a pointed question: why announce a model you won’t let anyone use?⁹ Reminiscent of the 2019 concerns by Elon Musk over “fake text generators” that have evolved into today’s generative AI tools, ¹⁰ a leading AI lab has acknowledged that a model’s capabilities are too dangerous for general deployment even as it demonstrates performance that makes every other frontier model look like a previous generation.¹¹ That’s either responsible caution or the most effective product launch strategy in recent memory… and it may be both.

Critics have noted that restricting the model to a small group of large corporations creates a technology asymmetry that benefits incumbents, and that the 12-partner structure resembles a “private security cartel.”⁷

The organizations with Glasswing access are the same organizations that build the software the rest of the industry depends on. Whether that’s a feature or a concern depends on your perspective.

Our view: it’s probably the right call for now, but not for the reasons Anthropic emphasizes. The more important reason is that most organizations aren’t structurally ready to absorb thousands of new critical vulnerability disclosures per quarter. The limiting factor isn’t model access. It’s remediation capacity.

What to do right now

This is the section that matters. Not “how do I get Glasswing access” — but “given this announcement, what does my organization actually need to do?”

Start with where you are, not where Anthropic’s marketing wants you to feel you’re falling behind.

A genuine capability shift has occurred in AI-assisted vulnerability discovery for defenders. That shift will matter more to your organization’s security posture over the next 12-18 months than anything you do in the next two weeks in response to this announcement. The right response is measured, standards-grounded, and begins with honest posture assessment — not a reactive vendor conversation.

If you are a vendor, read the Vendor Conversation Starters we created for customers to ask vendors at RSAC about AI usage in their product and work the questions in the “bingo card.”

If you are a company worried about disruptions from offensive operations, read “Nimbleness is your next step” and work the 5 steps and 15 questions to prioritize your risk management and cyber defense capabilities today.

If you’re looking for a temperature check on top priorities, read our Dispatches from the 2026 RSAC Hallways for insights from executive leaders, policy makers, vendors and attendees.

If you want to dive deep on our assessment of AI-enabled security, subscribe and follow our upcoming series on AI adversarial threat, enterprise risk, and cyber defense. You can filter for “Realis Risk Advisory” posts on our Substack for the full complement of articles.

What’s next

In our upcoming series, we’ll go deep on five capabilities that actually move the needle:

Where AI-assisted code security tooling improves leverage. In the CI/CD pipeline, catching vulnerabilities before they ship, rather than in retrospective scanning of legacy codebases. That’s where the Mythos use case ultimately points — and where the practical entry point for most security teams lies.

Compensating for the AI adversarial threat landscape. Dive into how the weaponization of AI for offensive operations matches up to defender capabilities. Learn how to think about what else, beyond vulnerability, gives your opponent a leg up over your security teams.

Your existing AI-enabled cybersecurity tools. The partner organizations in Glasswing — Microsoft, CrowdStrike, Palo Alto, Cisco — all have AI-assisted capabilities already embedded in Sentinel, Falcon, Cortex, and SecureX. Most organizations aren’t extracting full value from what they’ve already licensed. That’s the first conversation to have before evaluating any new tooling.

The case for standards as your baseline. ISO 27001, SOC 2 Type II, and CIS benchmarks give you an objective, auditable posture score. They also give you a defensible answer when your board asks “what are we doing about this?” — one grounded in established frameworks rather than vendor urgency.

Remediation agility and patch velocity. Your current mean-time-to-patch for critical CVEs is the single metric that tells you more about your ability to benefit from products like Claude Mythos than any benchmark. If you can’t remediate what you already know about, adding AI-powered discovery makes the problem worse, not better.

Project Glasswing is a real event wrapped in a commercially amplified announcement. The threat it describes is genuine. The urgency it implies is calibrated to sell things.

Your job is to separate the two and act on the former without being stampeded by the latter.

Realis Solutions Group

About Realis Solutions Group

Realis Solutions Group empowers organizations to navigate emerging technology with clarity and resolve. Executives, boards, attorneys, and compliance professionals seek us out for our sharp and steady advisory and technical skills married with executive acumen. Our team is proven under fire leading and advising for over 73% of the Fortune 100, driving real results with multi-million and multi-billion dollar returns.

In support of our empowerment mission, we publish digestible, focused, and well-cited analysis connecting business outcomes emerging risk and technology topics like advanced threat, AI, and cyber risk.

Engage with us

Hire Realis to tailor your approach - we’re with you from boardroom to courtroom
- From product security and safety roadmaps to CxO and Board-level strategic direction, to attorney focused services including expert services we can help! Schedule a meeting
Explore our portfolio of solutions
- Online at our website: https://realissolutions.com/

Visit us on AWS Marketplace

Meet us in London at THE-C2 2026
- Our CEO & Founder Emily Soward will be speaking: “Operationalize the intelligence you have to provide Board-actionable foresight on emerging risk”
Invite us to join you for an event or broadcast, collaborate, or answer your inquiry
- We ruthlessly prioritize sharing experience-based insights that that most plague our clients, and are always open to speaking with
  - Media, Collaborations, & Inquiries: Request Form
Let us know what we missed
- Integrity matters. We drive for factual, citable, and current themes that stand up under scrutiny. Let us know if we can improve our understanding.
  - Corrections: Request Form
Join our online community
- Give us a follow at https://www.linkedin.com/company/realis-solutions-group/ so you never miss our public engagements, announcements, and commentary on the emerging risk landscape as events unfold.
Get deep insights from practitioners to your mailbox

Subscribe for free to receive new posts on driving risk and threat informed decision-making and strategy in organizations.

Contributors

Mike Reed is a Co-Founder and COO of Realis Solutions Group, with a career defined by being present at technology’s most pivotal moments — from launching Active Directory and Exchange at Microsoft, to the debut of the Apple iPhone, to building MSSP ISV partner ecosystems at AWS, and co-authoring the Guide to Secure AI Innovation at Fortra.

Holding a Master of Science in Management & Leadership from Tarleton State University, he has spent decades helping organizations adapt to and adopt transformative technologies before they become table stakes. A sought-after public speaker and frequent podcast guest, Mike brings a practitioner’s clarity to complex topics — translating emerging technology’s promise into frameworks organizations can actually act on.

https://linkedin.com/in/thatmikereed/

Note on this article: Emily Soward, Realis CEO & Founder, contributed partner analysis and perspective throughout this piece. Her 2025 RSTCON talk, Stop Trading Security For Predictive Power, covers how AI systems in operational technology create both diagnostic capability and new risk surfaces — a framework that applies directly to how we’re thinking about AI-assisted vulnerability tooling in enterprise environments.

Read her bio here: https://realissolutions.com/about.html

https://www.linkedin.com/in/eksoward/

Disclaimer

The content in this report is provided “as is” for informational purposes only. In the act of developing, disseminating and/or permitting dissemination of this content and any associated commentary and/or materials, neither the authors nor any representative of Realis Solutions Group LLC is in any way acting as an attorney for any party. This content is not intended to be, nor to substitute for, legal advice. The authors shall not become liable for any damages or losses whatsoever arising from the reliance on or use of this content by any third party. Consumers of this content and related information must conduct their own due diligence. Any reference to specific entities, products, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favor by the authors or the parties referenced.

This Disclaimer may not be removed from any distribution of this content.

Footnotes

Cimarron Buser

Apr 12

Mike - you've always been great at boiling it down and explaining what's real. I appreciate your opinion on this. I'm wondering whether you see larger enterprises moving towards the "castle wall" approach (maybe with some zero trust added in), even to the point of bringing in on-prem AI hardware to solve problems.

Realis Solutions Group

Discussion about this post

Ready for more?