On May 22, Anthropic published an initial update on Project Glasswing, the company’s restricted cybersecurity research program that gives roughly 50 vetted partner organizations controlled access to Claude Mythos Preview, an AI model purpose-built for vulnerability discovery and exploit construction. Partners include AWS, Apple, Cisco, Cloudflare, CrowdStrike, Google, JPMorgan Chase, Microsoft, Mozilla, and NVIDIA, among others.

The program identified more than 10,000 high or critical severity vulnerabilities. This is the most significant public disclosure of AI-assisted offensive security research to date. Over 10,000 high or critical vulnerabilities found not by human researchers alone, but by an AI model working in collaboration with them across the world’s most critical infrastructure.

This is what AI-powered vulnerability discovery looks like at scale. The dual-use implications are profound: the same capability that finds 10,000 vulnerabilities defensively is the same capability that an adversary would use offensively.

The race to deploy AI in security is no longer hypothetical. It is happening right now, under controlled conditions and eventually, it won’t be controlled.