Anthropic just put a coalition of nearly fifty organizations into the same project.

Anthropic just put a coalition of nearly fifty organizations into the same project. Apple, Google, Microsoft, AWS, Nvidia, Cisco, Broadcom, Palo Alto Networks, CrowdStrike, JPMorgan Chase, and the Linux Foundation are among them. Plus dozens more behind them.

That alone should get your attention.

The project is called Glasswing. At the center of it is a model called Claude Mythos Preview. It reads source code, finds zero-day vulnerabilities, and writes the exploit code that proves they’re actually dangerous. That last part is what’s new. It removes the delay between “we think this might be a problem” and “here’s the working proof.” That’s what’s about to accelerate the patch pipeline.

The name might ring a bell. Earlier this spring, Anthropic accidentally leaked draft materials about this model before any official announcement. That was part of the story in the last issue. The model that leaked is the same one running Glasswing now.

Here’s what it found.

Anthropic says the model scanned every major operating system and browser and found thousands of previously unknown flaws. The most detailed public confirmation has come from Mozilla. Firefox 150 ships with fixes for 271 vulnerabilities surfaced during their Mythos evaluation. One vulnerability the model surfaced: a 27-year-old bug in OpenBSD, an operating system purpose-built for security. Expert reviewers examined that codebase for decades. The AI found what they missed.

Here’s why this matters to you.

Most of you don’t write software. You buy it. You run vendor stacks. You manage business risk.

So the story isn’t “AI found some bugs.” The story is that the bar for what counts as “secure enough” just moved. And it’s going to show up in places you deal with every day.

You’ll hear people say this means every company now faces a nation-state-level attacker. That’s not the right read. The threat coming after most of your organizations is still a financially motivated criminal running a phishing campaign. Glasswing doesn’t change who’s coming after you. It changes how fast the software you depend on will need to be patched.

Procurement questionnaires. Cyber insurance applications. Regulatory guidance. Audit expectations.

If a model can review every line of code before it ships, the question flips. It stops being “should vendors do this?” and becomes “why aren’t they?”

Mozilla just made their move public. The vendors in your stack are making theirs privately, or not at all.

That changes your vendor conversations starting now.

Today, you probably ask vendors about their patching cadence and their last penetration test. Soon you’ll be asking whether they use AI-assisted code review. And if they don’t, that gap becomes part of your risk profile. Not just theirs.

The other thing to watch: speed. AI doesn’t just find vulnerabilities faster. It changes how exploits get built after the patch ships. For years, attackers have studied each new patch to figure out what was broken, diffing the old code against the new and writing a working exploit in a few days. AI compresses “a few days” to minutes. The patch itself becomes the exploit guide.

Disclosure systems were built for human-speed research. CISA’s coordinated disclosure process and the broader CNA framework already strain under volume. They were not designed for a world where a model can discover, chain, and exploit flaws on its own.

If your mean time to patch is measured in weeks, that window is getting more dangerous to leave open.

Here’s what I’d do this quarter.

1. Add one question to your vendor security reviews: “Do you use AI-assisted code review or vulnerability scanning on your codebase?” You don’t need a perfect answer. You need to know who’s thinking about it and who isn’t.
2. Check your actual patching performance. Not the policy. The real numbers. What’s your mean time to patch for critical vulnerabilities? If it’s over 30 days, Glasswing just gave you a concrete reason to push harder.
3. Ask your cyber insurance broker whether AI-audited code practices are showing up in renewal questionnaires yet. If not this year, ask when they expect it. Get ahead of the question.
4. Brief your board on the shift. Not the technical details. The standard for what counts as “reasonable security” is moving. Your board should hear that from you before they hear it from an insurer or an auditor.
5. Don’t panic-buy an AI security tool. The organizations that come out ahead will be the ones that build the workflows, the talent, and the governance around AI. Not just the tools. A tool without a process behind it is a toy.

The same class of AI capability will spread beyond this coalition. It always does. Defenders got a head start. The question is whether you use that lead to build real muscle or just watch from the sideline.

Do you know whether your critical vendors use AI in their code review process?

-Kip