Project Glasswing: 7 Changes Security Leaders Must Make Now

9 min read By FindSkill Team

Project Glasswing broke vulnerability management. 7 specific changes CISOs must make before cyber insurance, regulators, and attackers catch up.

Table of Contents

A week ago, Anthropic announced Project Glasswing and most enterprise security teams yawned. Another AI initiative, another corporate consortium, another press cycle.

A week later, Forrester published “10 consequences nobody’s writing about yet,” The Conversation ran a deep dive, and CrowdStrike’s CTO went on record with one sentence that should make every CISO stop scrolling: “The window between a vulnerability being discovered and being exploited by an adversary has collapsed. What once took months now happens in minutes with AI.”

This isn’t about Claude Mythos the model. You’ve read that story. This is about what enterprises now have to do differently — and most are already behind.

What Actually Happened on April 7

Anthropic announced Project Glasswing: a consortium of 12 companies and 40+ additional organizations building defensive cybersecurity tools powered by Claude Mythos Preview, a frontier model they’re not releasing publicly because it’s too good at finding vulnerabilities.

The 12 launch partners:

AWS, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks.

The commitment: $100 million in Claude Mythos Preview credits, $2.5 million to Alpha-Omega and OpenSSF via the Linux Foundation, $1.5 million to the Apache Software Foundation.

The mechanism: a single AI model scans critical software — operating systems, browsers, open-source infrastructure — and finds vulnerabilities faster than any human team can. The consortium then coordinates patches before the same vulnerability shows up in an attacker’s toolkit.

Anthropic has already reported Mythos Preview finding “thousands of high-severity vulnerabilities, including some in every major operating system and web browser.”

Cisco’s VP of Global Government Affairs Anthony Grieco put it on the record: “AI capabilities have crossed a threshold that fundamentally changes the urgency required to protect critical infrastructure from cyber threats.”

So far, so enterprise-announcement. Here’s where it gets uncomfortable.

Why This Is Different From Every “AI in Security” Story

The AI-in-security narrative has been running for two years. Vendors claim AI catches threats faster. Startups raise rounds on “AI-native SOC.” Boring.

What’s different now: Glasswing proves autonomous zero-day discovery works at scale. Not “AI helps humans find bugs.” Not “machine learning prioritizes alerts.” A single AI model finding thousands of previously unknown, exploitable vulnerabilities across infrastructure that runs the internet.

That breaks three assumptions your security program is probably built on:

  1. Vulnerability discovery is the scarce resource. It’s not anymore. Discovery is now cheap. Remediation is the bottleneck.
  2. Penetration testing prices reflect skill. They reflected access to skill. When AI has that skill, the $20K-$120K pentest business model evaporates.
  3. Nation-state zero-day stockpiles are strategic assets. They’re becoming inventory. Any stockpile that Mythos Preview can replicate in an afternoon is worth zero.

Forrester’s analysis is blunt: “This will break the vulnerability management playbook and perhaps the cybersecurity approaches of today.”

If your security strategy assumes “we’ll patch CVEs as they emerge from the disclosure pipeline,” that strategy died on April 7.

The 7 Changes Security Leaders Need to Make

Forrester published 10 consequences. We’ve compressed to 7 with specific actions — because the longer list is paralysis inducing and you don’t have time for paralysis.

Change 1: Audit your open-source maintainer exposure — this week

The bottleneck has shifted. Mythos finds vulnerabilities in minutes. Open-source projects staffed by volunteers can’t patch at that speed.

What to do:

  • List every critical open-source dependency in your stack
  • Flag the ones maintained by one or two people
  • Either fund those maintainers directly, replace the dependency, or build redundancy
  • Your SBOM (Software Bill of Materials) should already show you this — if it doesn’t, your SBOM tool is too shallow

Change 2: Rewrite your pentest contract language

If you’re paying $80K for a pentest in June on the assumption that the value is “finding bugs we haven’t found,” renegotiate.

What to do:

  • Shift contract language from “discovery” to “remediation guidance and legal defensibility”
  • Ask pentest vendors how they’re using AI — if they say “we don’t,” that’s an answer
  • Expect prices to drop 40-60% over 12 months. Don’t lock in current rates on multi-year contracts

Change 3: Stress-test your cyber insurance exclusions — before renewal

Cyber insurers are reading the same Forrester analysis you are. They’re already drafting exclusions for “AI-discovered vulnerabilities left unpatched beyond defined timeframes.”

What to do:

  • Pull your current cyber policy today
  • Search for “AI,” “autonomous,” “accelerated disclosure,” and “critical infrastructure”
  • If your renewal is in Q3 2026, expect premium shock
  • Establish a 72-hour patching SLA for anything tagged as AI-discovered by your vendors — it’s about to be the insurance threshold

Change 4: Stop depending on the CVE/NVD pipeline

The CVE triage system was overwhelmed in 2024. With Mythos-class discovery running at scale, it’s about to fail visibly.

What to do:

  • Build a parallel prioritization path that doesn’t wait for NVD enrichment
  • Use vendor-specific advisories (Microsoft MSRC, Apple Security, CrowdStrike Falcon) as primary sources
  • If your vulnerability management tool’s entire logic is “score by CVSS after NVD scoring” — it’s about to be broken
  • Consider tools like Tenable’s VPR, Rapid7’s Active Risk, or equivalent that decouple from NVD

Change 5: Assume overnight exploit capability

Nation-state zero-day stockpiles are becoming obsolete because “zero-day” is becoming a non-unique resource. Any adversary with API access to a capable model can find and exploit vulnerabilities at machine speed.

What to do:

  • Your detection stack needs to catch novel attacks without waiting for signatures
  • Behavioral/UEBA tooling (CrowdStrike Falcon, SentinelOne, Microsoft Defender XDR) becomes mandatory, not optional
  • Run purple-team exercises quarterly instead of annually
  • Treat all unpatched internet-facing systems as “probably compromised if targeted”

Change 6: Document AI validation workflows (for compliance)

EU AI Act, NIST AI RMF, SEC cyber rules — all three will likely anchor to Glasswing-era capabilities as the “high-capability” baseline within 12-18 months. You need evidence of human-in-the-loop review.

What to do:

  • Document every step where AI findings get human review before action
  • Capture review timestamps, reviewer identity, approve/reject decisions
  • Build this into your GRC platform (ServiceNow IRM, Archer, Drata, Vanta) now, not after a regulator asks
  • This becomes a compliance field within 18 months. Early movers define the market

Change 7: Retrain your team

If you have vulnerability researchers on staff, their job is changing. Finders become deciders. The skill in demand shifts from “can you find bugs” to “can you judge the right response under pressure.”

What to do:

  • Reallocate training budget from “offensive security certifications” (OSCP, OSEP, etc.) toward “risk decision frameworks” and “incident command”
  • Your university recruiting should emphasize systems thinking and judgment, not just CTF scores
  • The SANS, Offensive Security, and EC-Council certification market will take a decade to catch up — don’t wait for them

What the Big Vendors Are Already Doing

The Glasswing consortium members aren’t just announcing — they’re moving.

Microsoft: Integrating Mythos findings into Defender advisories. MSRC is already triaging AI-discovered bugs with human teams. Expect Patch Tuesday volumes to grow 20-30% through 2026.

CrowdStrike: Falcon is getting “Mythos-informed” threat intelligence. Unclear yet what that means operationally, but early briefings suggest AI-prioritized patch recommendations inside existing workflows.

Cisco: Published a joint blog pushing for “AI-assisted remediation” as the next vendor category. Expect announcements about their automation stack integrating Claude directly within the next 90 days.

Apple: Quiet as usual. But macOS Sequoia and iOS 19 security patches have shipped faster since April 7, which isn’t nothing.

Google: Using Mythos through Project Naptime equivalents internally. Chrome security releases have accelerated.

Linux Foundation / Apache: The $4M in open-source funding is being allocated now. If you depend on Alpha-Omega-covered projects (Kubernetes, Node.js, Eclipse Foundation projects), expect faster security releases.

What this means practically: your vendors are getting faster. Your patching cycles need to keep up, not stay on the old monthly cadence.

The Questions Nobody’s Answered Yet

Glasswing opens questions that matter more than the announcement itself:

Who pays when Mythos finds a critical vuln in a product you use? Disclosure responsibility isn’t settled. If Mythos finds a flaw in Acme Corp’s middleware, and Acme refuses to patch, what happens? Regulatory guidance coming but unclear.

What about vendors outside the consortium? If you run software from a company not in the 12 launch partners or 40+ additional participants, they may be blind to vulnerabilities Mythos has already found. Your supply chain risk just got bigger.

Can adversaries train their own Mythos equivalent? Open-source frontier models exist. The gap between Claude Mythos and a determined nation-state training run is measured in quarters, not years. That question hasn’t been addressed publicly.

What about your code? If you have SaaS products, internal APIs, or proprietary software — are you scanning it with AI before adversaries do? Glasswing is focused on “critical infrastructure” (OS, browsers, OSS). Your B2B SaaS app probably isn’t in scope.

What This Means for You

If you’re a CISO: Rework your FY26 budget toward remediation speed and documentation, away from discovery tools. Schedule meetings with your cyber insurance broker this month. Audit your SBOM. This is a once-in-a-decade shift in how security works.

If you’re a security engineer: Upskill toward “judgment under pressure” and “AI validation workflows.” Offensive security certs are less valuable than they were a month ago. Detection engineering and incident response are more valuable.

If you’re a security vendor or startup founder: The discovery-centric business model is dying. Pivot to remediation, governance, or AI-assisted response. Startups in the AI-governance-for-security space are the next wave.

If you’re in a non-security role that depends on uptime (SRE, infrastructure, platform): Your on-call rotations are about to get louder. Expect more emergency patches, more critical CVEs, more “drop everything” moments. Plan for it.

If you’re an individual developer or open-source maintainer: Your volunteer project just became load-bearing for global security. If you want funding, Alpha-Omega and OpenSSF are actively allocating now. Reach out.

The Bottom Line

Project Glasswing isn’t a new security vendor, a new cert, or a new framework. It’s a new baseline — one that makes the vulnerability management playbook every enterprise was running obsolete within a week of the announcement.

The question isn’t whether you’ll adapt. It’s whether you’ll adapt in Q2 2026 (still early, competitive advantage) or Q4 2026 (reactive, behind regulators and insurers).

Pick the timeline you can afford. Then start with Change 1 this week.

Want to go deeper? Our AI Agent Security course covers the threat model side. AI Security Auditing walks through the practical assessment workflows. For governance and compliance, AI Compliance Governance maps the regulatory framework.

Sources:

Build Real AI Skills

Step-by-step courses with quizzes and certificates for your resume