"An AI model that can generate zero-day vulnerabilities." That blunt assessment from The Reg frames a dilemma at the heart of Project Glasswing: a program described by Anthropic as a $100 million, AI-driven effort to find and fix long-hidden flaws in critical open source software — and one that, according to its critics, may also produce precisely the kinds of exploits defenders dread.
What Anthropic says: a coalition, $100 million, and Mythos
Anthropic describes Project Glasswing as "a coalition of tech giants committing $100 million in AI resources to hunt down and fix long-hidden vulnerabilities in critical open source software" that it is finding with a new AI program called Mythos. Those are the terms Anthropic has used to characterize the initiative and its capabilities.
The counterpoint: a model that can create zero-days
The Reg framed the same technical capability more starkly: "an AI model that can generate zero-day vulnerabilities." That line captures a central worry about tools that probe code at scale — that the same processes used to discover and remediate previously unknown flaws could also be repurposed to produce exploitable defects or to accelerate offensive research.
The tension between remediation and risk
Project Glasswing, as Anthropic describes it, pairs large-scale AI resources with a focus on critical open source projects. The stated aim — hunting down and fixing long-hidden vulnerabilities — is straightforward in concept: use AI to surface defects that human reviewers might miss. But The Reg's phrasing highlights the converse risk: the discovery capability itself may be dual-use, yielding knowledge that could enable new attacks if misused or exposed.
That tension is the defining question raised by the project as presented in the source material. If Mythos reliably finds deep, previously hidden vulnerabilities, those findings could improve security when responsibly remediated. At the same time, the capacity to automatically generate zero-day information raises concerns about handling, disclosure, and control of sensitive outputs.
Implications and outstanding questions
- Anthropic's description establishes the scale and focus of Project Glasswing: significant AI resources applied to critical open source software via the Mythos program.
- The Reg's characterization underscores the dual-use nature of such tools, signaling a debate over whether an AI that finds vulnerabilities is primarily a defensive asset or a potential offensive capability.
- From the facts presented, the central unresolved matter is governance: how findings will be managed, who will control access to them, and how the balance between remediation and risk will be struck.
The conversation framed by Anthropic's description and The Reg's critique leaves a simple, sharp question: can an AI-powered effort to make open source safer avoid becoming, by virtue of its power, a new source of risk? The answer will turn on how Glasswing's outputs are handled, who holds them, and whether the line between discovery and exploitation can be kept clear.
Source: https://go.theregister.com/feed/www.theregister.com/2026/04/10/project_glasswing/
