What Is Project Glasswing, and Why Does It Matter?
Project Glasswing is Anthropic’s initiative to make Claude Mythos Preview available for defensive cybersecurity before its capabilities become more broadly accessible. Its launch partners include Amazon Web Services, Apple, Google, Microsoft, Cisco, CrowdStrike, NVIDIA, Palo Alto Networks, JPMorganChase, Broadcom, the Linux Foundation, and others, representing the core of the world’s critical software infrastructure.
Anthropic restricted public access to Mythos for a clear reason: the same capabilities that make it invaluable for finding vulnerabilities make it extraordinarily dangerous in the wrong hands. In testing, the model produced a fully functional remote code execution exploit overnight with no human direction after engineers simply pointed it at a codebase before leaving work. In one containment test, an earlier version escaped its sandbox and then, unprompted, broadcast proof of the escape to publicly reachable websites. A researcher found out by receiving an unexpected email from the model while eating lunch.
The goal of Glasswing is to give defenders a head start: surface vulnerabilities, coordinate patches, and push fixes before adversaries develop equivalent AI capabilities. It is an urgent race, and the window is narrow.
Analysts estimate competing frontier AI models could reach comparable vulnerability-discovery capabilities within three to six months. The advantage defenders have right now is real, but it is not permanent.
What We’re Hearing from Clients and Prospects
Mythos has come up in sales conversations, monthly business reviews, and client strategy sessions across the board. A few themes are emerging consistently.
“Is this real, or is it marketing hype?”
This is the most common opening question, and a fair one. Clients in engineering, professional services, and financial services have all raised it in recent conversations. The honest answer: the capabilities are real, backed by documented evidence. Major institutions, including Microsoft, Google, CrowdStrike, and Cisco, have joined Glasswing because they believe the findings are credible. Whether every headline has been perfectly calibrated, the underlying shift in vulnerability discovery capability is not hype. The consensus we are reaching with clients is that the gaps being exposed were real before Mythos arrived. They are even more dangerous now.
“We didn’t realize how far behind our patching actually was.”
This is where the Mythos conversation consistently becomes a mirror. When clients begin auditing their patch posture in response to Glasswing, they often discover coverage gaps that have existed for months. We have seen workstation patching compliance sitting at 65–70% in environments with hundreds of endpoints and limited visibility into the full software title inventory those machines are running. That is not a Mythos problem. That is a pre-existing exposure that Mythos makes significantly more urgent.
The operational gap that comes up most often is reboot compliance. A patch that has been deployed but not rebooted into is a patch that has not happened. For organizations migrating between endpoint management platforms, or those that have never enforced reboot policies, this is frequently where patching programs break down in practice.
“What should we actually do?”
Prospects evaluating Corsica are now explicitly using Mythos as part of their decision-making framework. In recent discovery conversations, we have had prospects in the 80–150 endpoint range request dedicated technical calls with our security leadership specifically to discuss the AI threat landscape and what it means for their environment. The question underneath the question is always the same: does your security program account for a world where AI finds vulnerabilities faster than traditional patching cycles can keep up? That is the right question to ask.
A Flood of Patches Is Coming. Is Your Organization Ready?
Here is what Glasswing means in practical terms for IT and security teams: the volume of patches being released is about to increase sharply as vendors absorb Mythos findings and accelerate remediation timelines. April 2026’s Patch Tuesday addressed 163 CVEs, a number that reflects vendors already responding to AI-assisted vulnerability discovery. The Cloud Security Alliance put it plainly in their April 2026 guidance: “Security organizations will likely be overwhelmed by the need to apply patches and respond to AI-discovered vulnerabilities.” Current patch cycles, incident response processes, and risk metrics were not built for this environment.
What This Means for Patch Tuesday—and Every Other Tuesday
Patch Tuesday has long been a reliable drumbeat: second Tuesday of the month, triage, test, deploy. That cadence may not hold as the pace of disclosure accelerates. Some vendors may shift toward more frequent, asynchronous patch releases, pushing critical fixes as findings are validated rather than bundling them into monthly cycles. Organizations that have built rigid patch windows may find those windows becoming liabilities rather than safety valves.
Open-source exposure compounds the problem significantly. Unlike major commercial vendors with large security teams, open-source projects are often maintained by small volunteer communities with limited bandwidth. When Mythos surfaces vulnerabilities in a widely used open-source library, the remediation timeline depends on that community’s capacity, not the urgency of the issue. AI can discover vulnerabilities exponentially faster than volunteer teams can fix them, creating a structural gap that organizations running open-source components cannot ignore.
What This Means for Mid-Market Organizations
If you are running a business with 100 to 500 users, you are likely not a Project Glasswing partner. You do not have CrowdStrike’s security team or AWS’s patching infrastructure. But you are running the same Windows Server instances, the same web browsers, and the same open-source software components—and those are exactly what Mythos has been scanning.
Here’s what this means for midmarket companies:
- Patch-stale devices are a more acute risk. A device two or three patch cycles behind may now harbor vulnerabilities that were unknown a month ago but are already documented, patched by vendors, and actively being tracked by threat actors monitoring disclosure timelines.
- Reboot compliance matters more than ever. A patch that has been deployed but not rebooted into has not happened. This gap is more common than most organizations realize, and it is one of the most straightforward things to fix right now.
- Open-source and third-party application visibility is critical. If your publicly accessible web applications or internal tools rely on open-source components, those dependencies need to be inventoried and monitored against disclosure timelines as Glasswing findings continue to roll out.
- The definition of “stale” needs to shrink. In a world where a zero-day can be discovered and weaponized within hours, a 30-day patching lag carries a fundamentally different level of risk than it did six months ago. Tighter alert thresholds for behind-schedule devices are warranted.
- Continuous patching models are worth evaluating seriously. The shift from monthly patch cycles to automated, continuous deployment is a conversation we are having with clients across industries right now. It is no longer a best practice to aspire to; it is becoming a baseline requirement in regulated environments.
Corsica is proactively reviewing client environments for reboot compliance and patch currency as Glasswing disclosures continue. If you are not sure where your organization stands, that is exactly the conversation to have now.
The Short-Term Advantage and Its Limits
Project Glasswing gives defenders a temporary advantage. The good guys, as I noted in a recent discussion with our operations team, are getting a head start. Tech firms inside Glasswing can evaluate their products against Mythos findings, surface critical vulnerabilities, and accelerate patches before adversaries develop comparable capabilities.
But that advantage is constrained by operational reality. Knowing a vulnerability exists does not automatically mean you can patch it. In complex environments—especially in healthcare, manufacturing, and financial services, where systems cannot easily be taken offline—patch deployment is governed by uptime requirements, legacy dependencies, and change management processes. The patch window that protects production stability can also protect a vulnerability.
This is why threat and vulnerability management programs cannot just track what has been patched. Rather, they need to actively account for what has not been deployed and why. The organizations that will navigate this period best are those that have invested in automation, strong configuration management, and MSP or MSSP relationships that can move quickly when new disclosures land.
What Corsica Is Doing to Stay Ahead
Our security operations team has been tracking Glasswing closely and has already begun adjusting how we approach patch currency thresholds for client environments. A few specific areas we are focused on:
- Tightening patch stale alert thresholds. We are evaluating whether current thresholds for flagging behind-schedule devices need to compress, particularly for critical and high severity patches. A 30-day lag carries significantly more risk than it did six months ago.
- Reboot enforcement review. For clients migrating between endpoint management platforms, we are actively auditing reboot status to ensure deployed patches are actually in effect, not just deployed.
- Glasswing vendor tracking. We are closely monitoring software vendors participating in Project Glasswing, like Cisco, Palo Alto Networks, CrowdStrike, and others. We are ensuring client environments are patched rapidly when those vendors push Glasswing-informed updates.
- Proactive communication on patch volume. We are preparing clients for the likelihood of higher-than-normal patch cadences from major vendors in the months ahead. Do not be surprised by it. Rather, understand why it is happening and what it requires operationally.
- Expanded security assessments. For clients who want a comprehensive view of their exposure in light of Mythos, we are conducting environment reviews covering patch posture, endpoint coverage, software title visibility, and BCDR readiness.
What You Should Do Now
You should not wait to take meaningful action. The playbook for this moment is one good security hygiene has always called for. It just became considerably more urgent:
- Audit your current patch currency. How far behind are your most critical devices and systems? Do you have documented exceptions? Are those exceptions still justified given the current threat landscape?
- Confirm reboot compliance. A deployed patch that has not been rebooted into is not protecting you. Verify your fleet is actually running patched versions, not just targeted for patching.
- Inventory your open-source dependencies. If you run web applications or internal tools that rely on open-source packages, map those dependencies and establish monitoring for CVE disclosures against them.
- Stress-test your patch deployment speed. When a critical patch drops from a Project Glasswing vendor, how long does it actually take to go from released to deployed across your environment? If the honest answer is weeks, that needs to change.
- Consider a security assessment. If you do not have a clear picture of your vulnerability exposure today, or if Mythos has surfaced questions your team cannot answer confidently, a structured environment review is the right starting point.
The Bigger Picture: A Structural Shift, Not a Temporary Spike
The security community is largely aligned on one point: what Mythos represents is not a temporary surge in vulnerability disclosures. It is a permanent acceleration. AI-assisted vulnerability discovery will not stay exclusive to Project Glasswing. Adversaries will develop equivalent capabilities, possibly within months, and the lag between vulnerability discovery and exploitation will continue to compress.
Systemic resilience is the goal: not catching every vulnerability before an adversary does, but building the organizational muscle to respond faster, patch smarter, and recover better when a gap is exploited. The conversations we are having with clients right now—about patch coverage, reboot compliance, software visibility, and BCDR—are not new topics. Mythos is making them impossible to defer.
Your patch management strategy is one of the most important pieces of that resilience. Make sure it was built for the world you are actually in.
