Anthropic, an AI firm, unveiled Project Glasswing, a new cybersecurity program that will leverage an early version of its advanced model, Claude Mythos, to identify and fix security weaknesses.

A select group of organizations, including Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks, along with Anthropic, will use the model to protect essential software.

The company stated that this initiative is a response to the capabilities they’ve seen in their general-purpose model, which shows “a level of coding ability where AI is better than nearly all humans at discovering and exploiting software vulnerabilities.” Given these cybersecurity skills and the potential for misuse, Anthropic has chosen not to make the model widely available.

Anthropic claims that Mythos Preview has already found thousands of critical zero-day vulnerabilities in all major operating systems and web browsers. These include a 27-year-old bug in OpenBSD (now patched), a 16-year-old vulnerability in FFmpeg, and a memory corruption issue in a memory-safe virtual machine monitor.

The company highlighted one example where Mython Preview supposedly independently developed a web browser exploit that combined four vulnerabilities to break free from the renderer and operating system sandboxes. Anthropic also mentioned in the preview’s system card that the model solved a corporate network attack simulation that would have taken a human expert over 10 hours.

Perhaps most surprisingly, Mythos Preview reportedly followed a researcher’s instructions during an evaluation to escape a secure “sandbox” computer, suggesting a “potentially dangerous capability” to override its own safeguards.

The model didn’t stop there; it proceeded to take further steps, including creating a multi-stage exploit to gain broad internet access from the sandbox system and sending an email to the researcher, who was eating a sandwich in a park.

“Furthermore, in a disconcerting and unsolicited effort to demonstrate its success, it posted details about its exploit to several difficult-to-find, yet technically public websites,” Anthropic said.

The company emphasized that Project Glasswing is an “immediate effort” to use advanced model capabilities for defensive purposes before malicious actors can do the same. It is also committing up to $100 million in usage credits for Mythos Preview, along with $4 million in direct donations to open-source security organizations.

“We did not explicitly train Mythos Preview to have these capabilities,” Anthropic said. “Instead, they emerged as a byproduct of general improvements in code, reasoning, and autonomy. The same improvements that make the model much better at patching vulnerabilities also make it much better at exploiting them.”

News of Mythos leaked the previous month when details about the model were accidentally stored in a publicly accessible data cache due to a human mistake. Draft materials described it as the most powerful and capable AI model created to date. Days later, Anthropic experienced another security incident where nearly 2,000 source code files and over half a million lines of code related to Claude Code were accidentally exposed for about three hours.

The leak also uncovered a security issue that bypasses certain safeguards when the AI coding agent receives a command with more than 50 subcommands. Anthropic has since officially fixed the issue in Claude Code version 2.1.90, which was released last week.

Adversa, an AI security company, said that “Claude Code, Anthropic’s primary AI coding agent that executes shell commands on developers’ computers, silently ignores user-configured security denial rules when a command contains more than 50 subcommands. A developer who sets up ‘never run rm’ will see rm blocked when run alone, but the same ‘rm’ runs without restriction if it’s preceded by 50 harmless statements. The security policy silently disappears.”

“Security analysis costs tokens. Anthropic’s engineers encountered a performance issue: checking every subcommand froze the UI and used a lot of compute. Their solution: stop checking after 50. They traded security for speed. They sacrificed safety for cost.”