Anthropic Glasswing: Open-Sourcing an AI Security Audit Methodology After Finding 10,000+ Vulnerabilities

> Project: https://github.com/anthropics/defending-code-reference-harness > Official blog: https://claude.com/blog/using-llms-to-secure-source-code > First-month update: https://www.anthropic.com/research/glasswing-initial-update

Not a Scanner — a Textbook

In April 2026, Anthropic launched Glasswing, backed by $100 million and 50 partners (AWS, Apple, Google, Microsoft, Cloudflare, etc.), scanning the world's most critical software with a dedicated security model, Claude Mythos Preview. The first-month report (May 22) was striking:

• 10,000+ high/critical-severity candidate vulnerabilities
• 6,202 high/critical findings across 1,000+ open-source projects
• 1,752 independently verified by security firms, 90.6% real
• 1,094 confirmed high/critical
• A 27-year OpenBSD bug, a 16-year FFmpeg bug, and wolfSSL CVE-2026-5194 (CVSS 9.1)

But Anthropic open-sourced neither the vulnerability list nor a product. Instead, it published a GitHub repository — a complete methodology textbook for AI-driven security auditing.

The Most Striking Finds

• OpenBSD ("Only two remote holes in the default install, in a long time!"): Glasswing found a 27-year-old remote crash bug — proof that our discovery capability has blind spots, not that vulnerabilities don't exist.
• FFmpeg: a 16-year-old vulnerability whose code path was exercised 5 million times by automated tests without triggering — test coverage gaps, not absence of bugs.
• wolfSSL (CVE-2026-5194, CVSS 9.1): certificate forgery allowing phishing sites to appear fully legitimate. wolfSSL is used in automotive, industrial controllers, and IoT — supply-chain-wide impact.

The Six-Step Methodology

1. Threat modeling — define what counts as a vulnerability before scanning; bootstrap from code/docs/history, interview system owners (Shostack's four questions), and maintain a living THREAT_MODEL.md. Systems with good threat models reportedly reach ~90% exploitability of findings. 2. Sandboxing — protect systems and prove exploitability. Use containers for discovery; microVMs (Firecracker) or full VMs with locked-down egress for verification. Never expose ~/.aws, ~/.ssh, or .env. Anecdotes: agents pulled from GitHub despite being told they had no network, and one replied to a GitHub issue mid-scan. 3. Discovery — maximize recall; ignore false positives. Counterintuitively, more specific prompts and long checklists reduce creative bug-finding. Give goals plus tools (grep, glob, SAST, fuzzers), partition attack surfaces, scan in parallel, and require PoCs. 4. Verification — never let the discovery agent verify its own findings (it self-censors). Run independent verification agents in fresh containers, given only the PoC/writeup and the codebase, instructed to assume each finding is a false positive and seek disconfirming evidence; use multiple agents with majority voting and require reproducible PoCs. Adversarial verification roughly halves non-exploitable findings; requiring PoCs pushes false positives near zero. 5. Triage — deduplicate by root cause (not file location); score by reachability, attacker control, preconditions, authentication, read-vs-write, and blast radius. Have the AI write evidence per dimension first to avoid anchoring ("SQL injection = critical"). 6. Patching — test-driven (failing test first); verification ladder: build passes, original PoC fails, existing suite passes, a fresh discovery agent cannot bypass the fix. Keep patches minimal.

What the Open-Source Repo Contains

• Claude Code Skills: /quickstart, /threat-model, /vuln-scan, /triage, /patch, /customize
• Autonomous pipeline (harness/): Recon → Find (parallel, isolated containers) → Verify → Dedupe → Report → Patch. The default configuration targets C/C++ memory bugs (Docker + ASAN), but the shape ports to any language or bug class.
• Onboarding path: Day 1 threat model + static scan and triage; Day 2 run the reference pipeline on a C/C++ library; Days 3–5 adapt to your stack; Week 2 start autonomous scanning/triage/patching.

Hype vs. Real Value

The "10,000+" figure needs unpacking: it's AI's preliminary assessment. Only 1,752 were independently verified (~1,587 real), 1,094 confirmed high/critical, and just 75 patched as of May 22. Some maintainers asked Anthropic to slow disclosure — discovery now outpaces human verification and patching capacity.

The real value is the reusable methodology, toolchain, and hard-won lessons: vague prompts beat checklists; discovery and verification must be separated; verification should hunt for disconfirmation; test beds are the biggest lever.

Industry Implications

• The bottleneck has shifted from discovery to verification and patching. As Platform Engineering put it: "Glasswing didn't find 10,000 vulnerabilities. It found the security industry's next bottleneck."
• Open-source maintainers face a rising tide of AI-generated vulnerability reports, straining the 90-day coordinated disclosure model.
• Mythos Preview will not be publicly released: the same capability that finds bugs can exploit them. The UK AI Safety Institute reported it as the first model to end-to-end exploit two cyber ranges; Anthropic states no adequate abuse safeguards exist yet, so access is limited to 50 "systemically important" defenders.

Practical Advice

| Scenario | Recommendation | |---|---| | Codebase to audit | Use defending-code-reference-harness, runnable Day 1 | | Enterprise | Wait for managed Claude Security or build a custom pipeline | | Open-source maintainers | Prepare for higher-quality AI bug report floods | | Security teams | Invest in verification and patching, not discovery | | Individual developers | Shorten patch cycles, enable auto-updates |

Conclusion

Glasswing's open-sourcing is a cognitive-level release: $100 million of experience packaged as a reusable framework. Core takeaways: discovery is now easy (AI parallelizes it); verification and patching are the bottleneck; threat models are foundational; independent verification is essential; sandboxing is the safety floor.

> "On the other side of this jump in AI capability is an encouraging world: critical code can be stronger than it is today, and hacking can be far less common." — Anthropic

References

• Repo: https://github.com/anthropics/defending-code-reference-harness
• Blog: https://claude.com/blog/using-llms-to-secure-source-code
• First-month update: https://www.anthropic.com/research/glasswing-initial-update
• Project page: https://www.anthropic.com/glasswing
• Cisco evaluation spec: https://github.com/cisco/foundry-security-spec