What Happened

Anthropic announced Project Glasswing, a partner-heavy initiative where a closed group of organizations use Claude Mythos Preview for defensive work. Anthropic says the model can autonomously identify and develop exploits for serious vulnerabilities, and claims it has already found thousands of high-severity issues across major operating systems and browsers. Anthropic is committing up to $100M in usage credits for the effort, plus $4M in donations to open-source security organizations.

In Anthropic’s framing, the risks are not hypothetical: as similar capabilities proliferate, the “lag” between discovery and exploitation collapses. IANS Research summarizes this as the shift toward a world where there is “zero lag between discovery and exploitation,” a point their faculty emphasize as the new operational baseline security teams should prepare for.

The Non-Obvious Angle: Vulnerability Management Is About to Become an Industrial Throughput Problem

Security people already live in a world of more findings than fixes. Mythos-style capability does not just increase the finding rate. It changes the shape of the workload. When discovery and exploit development are automated and autonomous, the queue of “known bad things” grows faster than your ability to test, schedule downtime, and roll patches without breaking production.

Adrian Sanabria’s quote in the IANS piece is the brutally honest version: the bottleneck is not “generating more patches,” it is deploying them into infrastructure you are not allowed to take offline. That is the part of the story most AI headlines politely skip, because it’s less cinematic than “superhacker model.”

Why This Matters

• The defender advantage is temporary: as Bruce Schneier notes, the problem isn’t only Mythos. Older, cheaper, public models are already capable of replicating pieces of the workflow. The gap between finding and reliably weaponizing is real, but it is shrinking.
• Critical infrastructure is where this gets ugly: the systems that matter most (banks, healthcare, utilities) are often the hardest to patch quickly, because uptime is not optional and dependencies are ancient.
• “Trusted access” becomes market structure: if the sharpest tools stay gated (partners, allowlists, monitored programs), then access controls, audit logs, and procurement channels become the new competitive moat. Capability containment is turning into a product tier.

So What Do You Do (If You’re Not One of the 50 People With the Fancy Preview Model)?

The useful response is boring, which is how you know it’s real:

• Compress emergency change: if you can’t patch outside your normal release cadence, you are functionally volunteering to be exploited first.
• Inventory the unpatchable: identify systems you cannot update quickly (or at all), and plan compensating controls. “We’ll get to it later” is not a strategy when later is minutes.
• Practice curtailment for software: you need an operational playbook for disabling features, isolating systems, or rolling back quickly. The response pattern from grid reliability is about to show up in IT: controlled load shedding, but for services.