Project Glasswing & Claude Mythos: When an Unreleased AI Found 10,000+ Zero-Days — Including OpenBSD's 27-Year-Old Crash Bug

TL;DR

• Project Glasswing is Anthropic's defensive coalition program. Twelve partners get gated access to Claude Mythos Preview, an unreleased frontier model, to find and fix critical software vulnerabilities ahead of disclosure.
• Mythos's discovery record to date: more than 10,000 high- or critical-severity issues, including thousands of zero-days. Across >1,000 OSS projects, 23,019 issues flagged total.
• Headline finds: a 27-year-old remote-crash in OpenBSD, a 16-year-old bug in FFmpeg that fuzzers had hit 5,000,000 times without catching, and a 17-year-old unauthenticated remote root in FreeBSD NFS (CVE-2026-4747).
• Coalition: AWS, Apple, Cisco, CrowdStrike, Google, JPMorgan Chase, Microsoft, Palo Alto Networks, and the Linux Foundation among the 12 partners. $100M in usage credits + $4M in OSS grants.
• The strategic context: announced the same day as Opus 4.8 and Anthropic's $965B Series H ($65B raised). Anthropic now exceeds OpenAI's private-market valuation. Glasswing reads as both safety positioning and a recruiting tool for enterprise security buyers.
• The uncomfortable axis: Mythos's capability is symmetric. The same model that finds the FreeBSD NFS bug for the Linux Foundation is the model an attacker would want for offensive use. Glasswing's bet is that defenders win the early innings — but the model exists either way.

What Glasswing actually is

Strip the marketing: Glasswing is a gated alpha program for an unreleased Anthropic model called Mythos, designed around vulnerability discovery and patch-coordination. The structure is unusual in three ways:

1. Partner selection is intentional. Only 12 organizations get access. They were picked for ability to act on findings — Linux Foundation owns coordinated disclosure for kernel/OSS code; AWS/Apple/MS own enormous proprietary surfaces; CrowdStrike/Cisco/Palo Alto can ship detections; JPMorgan represents enterprise consumers of all of the above.
2. Economic asymmetry is acknowledged. Anthropic is committing $100M in usage credits to the partners — defensive scans at this scale would otherwise be prohibitively expensive even for trillion-dollar companies. Plus $4M in open-source grants to fund the patch-side labor that finding-side AI doesn't reduce.
3. Public report planned. Glasswing's first public summary is scheduled for early July 2026. The vulnerability details Anthropic has shared so far are post-patch — the program is keeping responsible-disclosure timelines.

The finds, in plain detail

Three vulnerabilities have been disclosed in detail because their patches have shipped. Each is worth examining because they say something different about what AI vulnerability discovery is good at.

1. OpenBSD: 27-year-old remote crash

OpenBSD has a reputation for being one of the most security-hardened systems in deployment. It's used to run firewalls and other infrastructure where availability matters. Mythos found a bug — present since the mid-1990s — that allowed remote attackers to crash any OpenBSD machine just by connecting to it. No RCE; no privilege escalation; just a remote denial of service against a class of infrastructure where availability is the entire point.

What this says: long-lived code with strong human review is not safe from a model that can read every line cold without bringing assumptions. Twenty-seven years of OpenBSD audit culture didn't catch it; Mythos did.

2. FFmpeg: 16-year-old bug, missed by 5 million fuzzer hits

FFmpeg is in everything that touches video. The bug Mythos found had been hit by automated testing tools roughly 5,000,000 times without anyone catching it. This is the most technically interesting find of the three: fuzzing is the *standard* way to find this class of bug, and the standard way had failed for 16 years.

What this says: AI-driven static analysis has a non-overlapping failure mode from fuzzing. Fuzzers find code that crashes given random inputs; they don't find code that's reachable only via specific structured patterns that humans would call 'obviously wrong but never executed'. Mythos catches the second category. This is genuinely new capability — not 'fuzzing but faster.'

3. FreeBSD NFS: unauthenticated remote root (CVE-2026-4747)

Seventeen years old. Unauthenticated. Remote root from the internet. NFS server. This is the worst class of bug a modern OS can have — anyone connecting to the right port becomes root. The FreeBSD project's response was fast; the lesson is that NFS code as deployed in 2026 still ships paths where a sufficiently careful reader can see all the way to root.

What the 10,000+ number actually means

Anthropic's published claim: across more than 1,000 open-source projects, Mythos flagged 23,019 issues, of which 6,202 are estimated high- or critical-severity. The headline '10,000+ critical' rolls in some private-codebase finds from Glasswing partners. Three things to internalize about that number:

1. It's a lower bound on capability, not on real-world risk. Most of those 23,019 issues will get patched before they're weaponized. The defensive coalition pre-empts the obvious attacker move.
2. The false-positive rate matters and isn't published yet. A model that flags 23,019 issues might still have a high false-discovery rate. The public report in July is supposed to address this. Until it does, take the headline as 'Mythos generates 23,019 findings worth a human's time to review' — not 'Mythos found 23,019 actual bugs.'
3. The 27-year-old OpenBSD bug is the right calibration anchor. A 1990s C bug surviving until a 2026 AI scan reads it tells you what *exists* in the long tail of well-reviewed code. That's not a Mythos artifact; it's the state of every C codebase older than the iPhone.

The symmetric problem nobody's writing about

Three honest observations about the dual-use problem:

• Gating is real but bounded. Mythos is not on the API. Anthropic is restricting access to 12 partners. Capability uplift to attackers via Glasswing is roughly zero. But Mythos-class capability is also what every other frontier lab is racing toward — Gemini 4 (open-weight, Apache 2.0) ships frontier reasoning to anyone who can rent the GPUs.
• The clock is the asset. Glasswing's value is that defenders find and patch *before* equivalent attacker capability becomes accessible. Anthropic's bet is that this window is months, not weeks. If they're right, the OpenBSD/FFmpeg/FreeBSD class of bugs gets cleaned out of the most-deployed code before equivalent attacker capability lands.
• $100M in usage credits is the right shape. Defenders running this kind of scan at scale is expensive — without a credit pool, only AWS-scale orgs could afford it. Subsidizing the Linux Foundation and select infrastructure-critical partners is how you actually compress the patch timeline. This is more important than the model itself for the next 12 months.

The valuation context (and why this announcement landed when it did)

Glasswing was announced the same day as Opus 4.8 and Anthropic's $65B Series H at a $965B post-money valuation — surpassing OpenAI's last private valuation of $852B. Anthropic's run-rate revenue crossed $47B earlier in May. IPO speculation places a possible filing as early as October 2026.

Read in that context, Glasswing is two things at once: (1) a substantive safety initiative with real defensive value; and (2) a positioning move for enterprise security buyers who write nine-figure checks on the basis of 'this vendor does serious safety work.' Both readings are honest. The defensive value is independently verifiable in the public July report; the commercial value is already priced in to the Series H.

What this means for you, depending on who you are

If you ship software that depends on common OSS infrastructure

• Patch fast for the rest of 2026. Glasswing patches will land in waves. Track CVE feeds for openssh, openbsd, freebsd, ffmpeg, libssl, glibc, and the long tail of high-coverage libraries. Subscribe to your distro's security advisories.
• Audit your own dependencies for code shaped like the FFmpeg find — long-lived, high-coverage, fuzzer-resistant. Schedule a static-analysis sweep. The same class of bug exists in your codebase too.
• Don't wait for the July report. If your supply chain includes anything that Glasswing has touched, the disclosed patches are landing now.

If you run a security team

• Plan for a 6-12 month patch cycle of unusual intensity. Even if you're not a Glasswing partner, you're going to be receiving the patches. Capacity-plan accordingly.
• Re-baseline your detection assumptions. Mythos-class capability changes what an attacker can do in the recon phase. CrowdStrike, Palo Alto, and Cisco are in Glasswing partly because their detection products need to adapt to attacker workflows that include AI vulnerability discovery.
• Read the July public report when it lands. Treat it as the first ground-truth dataset on what AI vulnerability discovery actually finds in the wild — not Anthropic marketing.

If you build AI agents / use Claude Code

• Mythos is not in Claude Code. Don't expect it. The capability is gated for a reason.
• But: Opus 4.8 is in Claude Code, and Opus 4.8 inherits some of the static-analysis training that fed into Mythos. Code review tasks with xhigh effort on Opus 4.8 will catch more than Opus 4.7 did. Re-run your code-review prompts against 4.8 and see if you find anything 4.7 missed.
• Use the moment as a forcing function to clean up your own code. Bugs that Mythos would find in third-party OSS also exist in your repo.

What we don't know yet

• Mythos's actual false-positive rate — the public July report should disclose this. Until then, the 23,019 number is unanchored.
• When (if ever) Mythos-class capability ships outside the gate. Anthropic has not committed to a general-availability timeline. The dual-use risk shapes that decision.
• Whether the patch coordination scales. Finding 10,000 bugs is one bottleneck; getting maintainers to land 10,000 patches is another. The $4M OSS grant pool is acknowledgment that this is the harder side.
• How the other labs respond. Gemini 4 is open-weight. OpenAI has not announced an equivalent program. The competitive dynamics around defensive vs. offensive use will shape policy for the rest of 2026.

Bottom line

Project Glasswing is the first concrete sign that AI vulnerability discovery has moved from research demo to production capability. The OpenBSD, FFmpeg, and FreeBSD finds are genuine — they are the kind of bugs that exist in every long-lived C codebase, and the kind of bugs that human review and fuzzing have demonstrably missed. The defensive coalition shape is the right initial response, and the $100M credit pool makes it actually executable, not just announced. The unresolved question is what happens when equivalent capability becomes more widely accessible. Anthropic's bet is that the lead time is enough. The next twelve months will test that bet.