Claude Mythos and Project Glasswing: AI speeds up defense, but also lowers the cost of attack
The ComputerHoy article published on May 20, 2026 about Claude Mythos opens a discussion that goes far beyond the attention-grabbing headline. Yes, Anthropic presents its model as a system capable of finding vulnerabilities that escaped human review for years. But the central point is not a supposedly omnipotent AI that “hacks the world.” It is something more uncomfortable and more realistic: the technology lowers the cost, time and expertise required to discover critical flaws in widely used software.
That changes the cybersecurity equation. When an AI tool can review code, reason about dependencies and chain weaknesses with a level of effectiveness once reserved for highly specialized experts, defenders gain a potentially enormous advantage. The same system can help audit binaries, search for local flaws, validate patches or test attack surfaces before an adversary does. That is, in essence, the thesis behind Project Glasswing, the initiative Anthropic announced on April 7, 2026 to give early access to Claude Mythos Preview to major technology companies, cybersecurity firms and critical infrastructure organizations.
Anthropic itself frames the project as an urgent response to a new reality. In its Glasswing announcement, the company says Mythos Preview has already found thousands of high-severity vulnerabilities, including some in every major operating system and browser. It also says the program brings together partners such as AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks, with up to $100 million in usage credits and $4 million in donations to open-source security organizations. The message is clear: the window between discovering a flaw and exploiting it is getting narrower.
Anthropic’s red team reinforces that reading. In its technical report on Claude Mythos Preview, the company explains that even people without formal security training have been able to ask the model to find vulnerabilities and wake up the next day with a working exploit. The document also describes specific cases in FreeBSD, Linux and other environments where the model reportedly identified and exploited complex weaknesses in a mostly autonomous way. At the same time, Anthropic’s system cards page already lists “Mythos Preview” alongside its other April 2026 models, a sign that the company is documenting the system’s behavior with unusual detail for a model that has not been released to the general public.
Still, this is where the hype needs a brake. The critical reading also exists, and it matters. Tom’s Hardware questioned Anthropic’s more spectacular framing and warned that part of the “thousands” of vulnerabilities figure depends on a much smaller sample of manual reviews. It also noted that some findings involve old software or are not necessarily exploitable under real-world conditions. That nuance matters because it separates a lab demonstration from a massive operational capability in the real world.
Even so, the risk remains serious. Reuters reported that banks and regulators are already watching the issue closely, precisely because the problem is not Anthropic’s stated intention but the diffusion effect: if AI can detect deep flaws in decades-old systems faster than humans, it can also lower the barrier for malicious actors. In other words, the threat is not that AI completely replaces the hacker; it is that it multiplies the hacker’s productivity and reduces the technical access level needed to cause harm.
My reading is this: Claude Mythos does not inaugurate a science-fiction apocalypse; it inaugurates a race for speed. The advantage will no longer be only in discovering vulnerabilities, but in discovering, validating and fixing them before an adversary does. Project Glasswing is a reasonable attempt to push that capability toward defense, but it is also an admission: cybersecurity has entered a stage where reaction time matters as much as code quality. That forces companies, governments and security teams to work from a new assumption: if AI accelerates everyone, the side that patches first survives.