Anthropic announced on June 2 that it is expanding Project Glasswing — its AI-powered vulnerability discovery program — to approximately 150 new organizations across more than 15 countries, granting access to Claude Mythos Preview, its most powerful and most restricted model. The new cohort fills sector gaps from the initial phase: power, water, healthcare, communications, and hardware operators had limited representation when the program launched in early April with roughly 50 partners including Apple, Nvidia, Microsoft, CrowdStrike, and Palo Alto Networks. Existing partners have since surfaced more than 10,000 high- or critical-severity security flaws; SiliconAngle reported total vulnerabilities found have reached 23,000, with Mythos independently rating over a quarter as high or critical — a designation manually confirmed by Anthropic in 90.6% of reviewed cases. Several partners reported their bug-discovery rates rose more than tenfold with Mythos. Cloud data management firm Rubrik publicly confirmed its inclusion in the new cohort; the EU’s cybersecurity agency ENISA was also recently admitted.
Anthropic said the expansion followed weeks of close coordination with the security industry, open-source software maintainers, and the U.S. government. Partners are using Mythos beyond detection: they are writing patches, conducting penetration tests, scanning pre-release code, and converting legacy software into memory-safe languages. The controlled rollout reflects a specific concern Anthropic has been open about — unlike commercially available models, Mythos can not only identify exploitable vulnerabilities but chain multiple flaws together, substantially raising dual-use risk. The company said it plans to publish best practices for vulnerability reporting and develop broader industry standards for AI cybersecurity over time. The announcement came the same day as Anthropic’s confidential S-1 IPO filing with the SEC and Trump’s executive order establishing a voluntary government review framework for frontier AI models.