Anthropic Scales Project Glasswing to 150 Orgs in 15 Countries

Anthropic has tripled Project Glasswing, its program that aims the Claude Mythos security model at critical-infrastructure code, from 50 partner organizations to 150 across 15 countries. The pitch is simple and, if it holds, unsettling for the security industry: a frontier model that hunts for vulnerabilities and drafts the fix, running against the software that hospitals, utilities, banks, and open-source projects actually depend on. Our read is that the expansion is less a product launch than a bet that automated discovery-plus-patching can outpace the attackers who now use the same class of models to find bugs faster than humans can.

• Glasswing pairs model-driven vulnerability discovery with automated patch generation, then routes the fix to a human maintainer rather than committing it unattended.
• The jump from 50 to 150 organizations spans utilities, healthcare, financial systems, and open-source infrastructure across 15 countries.
• It arrives days after the US lifted national-security restrictions on Anthropic's Fable 5 and Mythos 5 models, freeing the security-tuned variant for wider deployment.
• The timing is not accidental: defenders are racing a world where the window from public disclosure to active exploitation has compressed from days to hours.

What is Project Glasswing, exactly?

Glasswing is Anthropic's applied-security program built around Claude Mythos, a model variant tuned for offensive and defensive security work. Instead of shipping the model as a general chatbot, Anthropic runs it as a pipeline against real, consented codebases: the model reads the source, reasons about exploitable paths, and where it finds a flaw it produces a concrete patch rather than a vague advisory. The output lands in front of a human maintainer, who accepts, edits, or rejects it. The distinguishing feature is that both halves, discovery and remediation, come from the same system, which is what lets it move at a pace an unaided team cannot match.

RelatedClaude Code Adds a Built-In Browser That Reads the Live Web

Why does the 50-to-150 jump matter?

Because it is the difference between a pilot and an operating program. Fifty design partners can be hand-held; 150 across 15 countries means the workflow has to survive messy legacy code, different regulatory regimes, and maintainers who did not build the tool and do not trust it by default. Anthropic is effectively claiming the false-positive rate and the patch quality are now good enough that a stranger's utility company can act on the output without a Claude engineer in the room. That is the real threshold for whether model-driven security scales past demos.

What does the machine do that a scanner cannot?

Traditional static analysis flags patterns: a tainted input reaching a dangerous sink, a missing bounds check, an unsafe deserialization call. It is fast and it is noisy, and it does not write you a correct fix. A model like Mythos reasons across files and intent, which lets it catch logic bugs a pattern matcher misses and, crucially, propose a patch that respects the surrounding code. The tradeoff is that a language model can be confidently wrong, which is exactly why Glasswing refuses to auto-merge. The human gate is not a limitation bolted on for optics; it is the load-bearing safety design.

Who is exposed if this works?

Anthropic is private, so there is no ticker to trade, but the signal for investors sits one layer out. Automated discovery-and-patch pressures the vulnerability-management and application-security tooling market that names like Palo Alto Networks and CrowdStrike sell into, because a chunk of that spend is people triaging scanner noise. If a model reliably ships reviewed patches, the value migrates from "find the bug" to "govern the agent that fixes it," and the vendors that own the maintainer's review surface capture it. The near-term read is not that security budgets shrink; it is that they reallocate toward orchestration and verification, and away from raw scanning headcount.

RelatedQwen3.7-Max Tops SWE-Bench Pro and Terminal-Bench 2.0

What are the failure modes?

Three stand out. A subtly wrong patch that passes review and introduces a new flaw is the nightmare case, and it is why maintainer trust has to be earned, not assumed. A model that misses a whole bug class creates false confidence, the same problem scanners already have. And there is the dual-use question: a system good at finding exploitable paths in critical code is, by construction, a system an adversary would love to point the other way, which is part of why the government restrictions existed in the first place. Anthropic's answer is consent, scoping, and the human gate, but those are process controls, not guarantees.

Our take

The honest version of this story is that both attackers and defenders now have the same accelerant, and the only question is who compounds it faster. Glasswing is a credible attempt to put the accelerant on the defender's side while keeping a human accountable for what ships, and the 150-org footprint suggests it is past the toy stage. What would make us believers is boring evidence: named vulnerabilities closed, high maintainer acceptance, and zero patches that reopen as new bugs. Discovery has always been the glamorous half of security. Glasswing is a bet that the unglamorous half, writing the fix, is where a frontier model earns its keep. If that bet lands, the scarce resource stops being people who find bugs and becomes people who can trust and verify a machine that fixes them.

Original analysis by GenZTech. Reporting informed by Anthropic.