Project Glasswing: An initial update

This post details the initial findings and learnings from Project Glasswing, which uses Claude Mythos Preview to identify high- and critical-severity vulnerabilities in critical software. It quantifies the scale of vulnerability discovery (over ten thousand found by partners, thousands in open-source projects), highlights the increased rate of bug finding (over ten times for some partners), and discusses the bottleneck shift from discovery to verification, disclosure, and patching. It provides external validation of Mythos Preview's performance through reports from the UK's AI Security Institute, Mozilla, XBOW, ExploitBench, and ExploitGym. The post also details the process of triaging and disclosing vulnerabilities, the challenges faced by software maintainers due to AI-generated reports, and the impact on patching cycles. It emphasizes the need for the software industry to adapt to the increased volume of AI-discovered vulnerabilities and for developers to shorten patch cycles.