Behind the Mythos hype, Glasswing has just one confirmed CVE

VulnCheck's analysis of Anthropic's Project Glasswing cybersecurity initiative has found just one confirmed Common Vulnerabilities and Exposures entry directly tied to the program. The analysis raises questions about how the real-world impact of Anthropic's Mythos model should be measured, given the limited publicly attributable results so far.

Project Glasswing is Anthropic's gated access program for cybersecurity applications of its Mythos model. The full picture of the model's true capability in this domain is not expected to be available before July 2026, according to the analysis. This follows Anthropic co-founder Jack Clark's recent statements about the world needing to prepare for more powerful AI models.

The findings come as OpenAI scales its Trusted Access program for GPT-5.4-Cyber, another AI model fine-tuned for defensive cybersecurity applications. Both companies are implementing controlled access programs for security professionals while the measurable impact of these AI tools on actual vulnerability discovery remains to be fully documented.