An AI Secretly Found 10,000+ Zero-Day Security Bugs Nobody Knew About — And It's Terrifying and Brilliant at the Same Time

I'm going to be straight with you: when I first read about what Anthropic's Claude Mythos did inside Project Glasswing, my jaw dropped. Not because it found security vulnerabilities — lots of tools do that — but because of the sheer scale, the depth, and the fact that nobody knew these bugs existed. Some of them had been sitting there, undetected, for 27 years.

What Is Project Glasswing?

Project Glasswing is Anthropic's new cybersecurity initiative, and it's built around an unreleased frontier model called Claude Mythos Preview. Here's the setup: Anthropic gave this model — which is not available to the public — access to some of the world's most critical software systems, with one goal: find vulnerabilities before the bad guys do.

The partners involved read like a who's-who of the tech industry: Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks. These aren't small players. These are the companies that run the world's infrastructure.

The Numbers Are Staggering

Here's what Claude Mythos actually found: over 10,000 high- and critical-severity zero-day vulnerabilities across the world's most critical software. We're talking every major operating system — Windows, macOS, Linux — and every major web browser. Vulnerabilities that nobody knew existed. Vulnerabilities that could have been exploited by nation-state hackers, ransomware gangs, or anyone else who found them first.

The kicker? Mythos reproduced vulnerabilities and developed working exploits on the first attempt in over 83% of cases. That's not a research paper stat. That's a real-world attack simulation success rate that most human penetration testers would dream of.

And then there's this: Claude Mythos uncovered a 27-year-old vulnerability in OpenBSD — an operating system literally famous for its security hardening. A flaw that survived almost three decades of scrutiny, found by an AI in what was presumably a matter of hours.

This Is Both Amazing and Terrifying

Let's be clear about what this means. Anthropic did not deliberately train Claude Mythos to be a vulnerability-finding machine. According to Anthropic, these capabilities emerged as a downstream consequence of general improvements in code, reasoning, and autonomy. They didn't build a hacking AI. They built a very capable general AI — and it turned out to be extraordinary at hacking as a byproduct.

That's the part that should make everyone in tech stop and think. We're not talking about a specialized cybersecurity tool. We're talking about a general-purpose model that, as a side effect of being good at code and reasoning, can find more security flaws than virtually any human team could.

Why Anthropic Is Keeping It Locked Up

Anthropic has made a decision: Claude Mythos is not going public. Their statement is unusually direct: "We are not confident that everybody should have access right now." They're expanding Project Glasswing to about 150 organizations across 15+ countries — but those are vetted partners, not open API access.

This is one of the most significant AI safety decisions I've seen a major lab make. They have a model that could be commercially valuable, and they're deliberately restricting it because the capability is too dangerous in the wrong hands. Whether you think that's the right call or too paternalistic, it's a genuinely interesting precedent in an industry that usually moves fast and asks questions later.

What Happens Now?

The good news: all those vulnerabilities are being patched. That's the whole point of Project Glasswing — find the flaws before attackers do, then fix them. Apple, Microsoft, Google, and the other partners are now working through a list of bugs that could have been catastrophic if they'd fallen into the wrong hands.

The complicated news: this genie is out of the bottle. Other AI labs are building models with comparable capabilities. The question of who gets access to AI-powered vulnerability discovery — and under what conditions — is now one of the most important policy questions in tech. Anthropic just forced that conversation to the front of the agenda.

I don't know if their approach is scalable long-term. But for now, the world's software is a little bit safer than it was yesterday. And that's something.

What's your experience? Drop a comment below! 👇 Do you think Anthropic is right to restrict access to Claude Mythos, or should powerful cybersecurity AI be more widely available to defenders?