A 27-year-old bug in OpenBSD. A 17-year-old remote code execution flaw in FreeBSD that gives root to anyone on the internet. A 16-year-old vulnerability in FFmpeg that automated testing tools ran past five million times without catching.
Anthropic's unreleased Claude Mythos Preview model found all of them. In weeks, not years.
On April 7, 2026, Anthropic announced Project Glasswing: a program that hands this AI vulnerability hunter to about 50 organizations responsible for the software the internet runs on. The goal is to find and fix critical bugs before attackers get AI models that can do the same thing.
Whether that head start is enough -- nobody knows. Here's what happened.
What Mythos Preview actually did
Claude Mythos Preview is a frontier model Anthropic hasn't released publicly. It wasn't trained specifically to hack. According to Anthropic, the vulnerability-finding capabilities "emerged as a downstream consequence of general improvements in code, reasoning, and autonomy."
In other words: they made the model better at coding, and it turned out a model that's really good at understanding code is also really good at breaking it.
Three of the most notable finds: bugs that survived decades of human and automated review.
Here's what stood out from the initial results:
OpenBSD (27-year-old bug): Mythos found a flaw in OpenBSD's TCP SACK implementation. An attacker could remotely crash any machine running the OS. OpenBSD is specifically designed to be secure. This bug survived 27 years of code review from security-focused developers.
FreeBSD (17-year-old RCE): The model autonomously identified and exploited a remote code execution vulnerability in FreeBSD's NFS implementation. Triaged as CVE-2026-4747, it allows an unauthenticated attacker on the internet to gain root access. Seventeen years. Sitting there in production code that runs critical infrastructure.
FFmpeg (16-year-old bug): FFmpeg encodes and decodes video for a huge chunk of the internet. Mythos caught a flaw in a line of code that automated testing tools had executed five million times without flagging it. The test coverage was there. The bug was too subtle for the tooling.
Anthropic says Mythos found thousands of high-severity zero-day vulnerabilities across every major operating system and web browser during initial testing.
How Project Glasswing works
The program design is simple. The implications are not.
Mythos scans, reports, maintainers patch, and findings go public within 90 days.
Anthropic gives participating organizations access to Claude Mythos Preview. Those organizations use it to scan their codebases for vulnerabilities. When Mythos finds something, the maintainers get time to patch before anything goes public. Anthropic committed to reporting publicly within 90 days on findings, fixed vulnerabilities, and improvements.
The 12 launch partners are AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks, and Anthropic itself. About 40 additional organizations also got access.
The financial backing is real:
$100M in usage credits plus $4M in direct donations to open-source security organizations.
$100 million in Anthropic usage credits go to Glasswing participants. On top of that, $2.5 million goes to Alpha-Omega/OpenSSF and $1.5 million to the Apache Software Foundation. Both are open-source security organizations that have historically been underfunded relative to the software they protect.
After the research preview wraps up, Claude Mythos Preview will be available through Claude API, Amazon Bedrock, Google Cloud's Vertex AI, and Microsoft Foundry at $25 per million input tokens and $125 per million output tokens.
The debate nobody's ignoring
Not everyone is applauding. Security researcher Bruce Schneier called the announcement "very much a PR play by Anthropic" and noted that reporters largely repeated Anthropic's talking points without much pushback.
Strong arguments on both sides. The truth probably sits somewhere uncomfortable in the middle.
The criticism falls into a few buckets:
Older models can do this too. Security firm Aisle replicated some of Mythos's findings using older, cheaper, publicly available models. If the capability already exists in the wild, restricting Mythos doesn't contain the threat. It just means Anthropic gets the credit for responsible disclosure while the actual attack surface stays open.
Only 50 organizations got access. A lot of critical open-source projects are maintained by small teams or individual developers. If the code that underpins half the internet's TLS libraries doesn't get scanned, who does the head start actually help?
The head start is temporary. Schneier put it bluntly: AI-powered zero-day exploitation "will happen -- I have no doubt about it -- and sooner than we are ready for." The advantage defenders have right now is measured in months, not years.
On the other hand, the counter-arguments hold weight too:
$104 million is real money. Usage credits for defenders, direct funding for underfunded open-source security orgs. That's not lip service.
These bugs were genuinely hidden. Whatever you think about the PR angle, a 27-year-old bug in a security-focused OS that survived continuous human review is not something older models were casually catching. The FFmpeg bug was run past five million automated test executions. Something new happened here.
Doing nothing isn't an option. If frontier models will inevitably develop these capabilities, giving defenders early access is strictly better than pretending the problem doesn't exist.
What this means for developers
If you write code that runs in production, here's what changes.
Your automated testing might not be enough. The FFmpeg finding is the loudest signal. Five million test executions passed through the vulnerable code path. Traditional static analysis, fuzzing, and coverage-based testing all missed it. AI-driven vulnerability scanning is becoming a new layer in the security stack, not a replacement for existing tools, but something they clearly can't substitute for either.
The disclosure timeline is compressing. When AI models can find thousands of zero-days in weeks, the window between "vulnerability exists" and "someone finds it" shrinks fast. Patch cycles measured in quarters feel dangerous in a world where a model can scan your entire codebase overnight.
Open-source maintainers need more support. This is the quiet takeaway. The $4 million to OpenSSF and Apache is a start, but the broader problem is structural. The people maintaining the software that Glasswing partners depend on often don't have the resources to respond quickly to bulk vulnerability disclosures.
What happens next
Anthropic committed to a 90-day public reporting cycle. That means by July 2026, we should see concrete data on how many vulnerabilities were found, how many were patched, and how the program performed.
The pricing signal matters too. At $25/$125 per million tokens, Mythos-class scanning won't be free, but it'll be accessible to mid-size companies and well-funded open-source projects. The question is whether that's fast enough.
Here's what keeps security people up at night: the same capabilities that make Mythos useful for defense work just as well for offense. Anthropic is betting that controlled access buys enough time to patch the worst holes before the capability spreads. Critics think the window is already closing.
I'm not sure either side is wrong.
FAQ
Q: What is Project Glasswing? An Anthropic program that gives select organizations access to Claude Mythos Preview, an AI model that can find zero-day vulnerabilities in software. The goal is to patch critical bugs before AI-powered exploitation becomes widely available.
Q: Is Claude Mythos Preview available to the public? No. Anthropic restricted access to about 50 organizations. After the research preview, the model will be available through the Claude API and major cloud providers at $25/M input tokens and $125/M output tokens.
Q: What kinds of bugs did Mythos find? Thousands of high-severity zero-days across every major OS and web browser, including a 27-year-old OpenBSD bug, a 17-year-old FreeBSD remote code execution flaw (CVE-2026-4747), and a 16-year-old FFmpeg vulnerability.
Q: Who are the Project Glasswing partners? AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks, and Anthropic. About 40 additional organizations also have access.
Q: Can other AI models find the same vulnerabilities? Some security firms have replicated findings using older public models, though the scale and autonomy of Mythos's discovery process appears to go beyond what was previously demonstrated.
Wrapping up
The results are hard to argue with: decades-old bugs in security-hardened codebases, found in weeks. The strategy -- restricted access, $100M in credits, 90-day disclosure -- is more debatable.
What's not debatable: AI models are going to find your zero-days whether you opt in or not. Glasswing's bet is that defenders should get there first.
Got thoughts on how AI changes the security game? Write about it on codebrainery.com.