Project Glasswing

Project Glasswing: Securing Critical Software for the AI Era

Today marks a significant milestone in cybersecurity with the announcement of Project Glasswing, a groundbreaking initiative spearheaded by Anthropic in collaboration with a consortium of leading technology companies including Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks. This ambitious project aims to address the escalating threat posed by advanced AI models to the world's most critical software infrastructure.

The Genesis of Project Glasswing: AI's Dual-Edged Sword

The core impetus behind Project Glasswing stems from the remarkable advancements observed in Anthropic's latest frontier AI model, Claude Mythos Preview. This unreleased model has demonstrated an unprecedented capability in identifying and exploiting software vulnerabilities, often surpassing human experts in speed and efficacy. Claude Mythos Preview has already uncovered thousands of high-severity vulnerabilities, impacting every major operating system and web browser, as well as a wide array of other essential software.

The rapid progress in AI development means that these powerful cyber capabilities could soon become widely accessible, potentially falling into the hands of malicious actors. The implications for global economies, public safety, and national security are profound, necessitating an urgent and collaborative response. Project Glasswing is conceived as a proactive measure to harness these AI capabilities for defensive purposes, ensuring that the advancements in AI are leveraged to protect, rather than compromise, critical digital infrastructure.

Claude Mythos Preview: A Paradigm Shift in Vulnerability Discovery

Claude Mythos Preview represents a significant leap forward in AI's ability to interact with and understand code. Its proficiency in identifying vulnerabilities is not merely about finding known flaws; it excels at discovering zero-day vulnerabilities – previously unknown security weaknesses that have evaded human review and automated testing for years. The model's ability to not only detect these flaws but also to autonomously develop sophisticated exploits highlights a new frontier in cybersecurity.

**Key Capabilities of Claude Mythos Preview:

• Vulnerability Detection: Identifies thousands of zero-day vulnerabilities across operating systems, web browsers, and critical software.
• Exploit Development: Autonomously creates sophisticated exploits for discovered vulnerabilities, often surpassing human capabilities.
• Code Reasoning: Demonstrates advanced understanding and reasoning about complex codebases.
• Agentic Coding: Excels in tasks related to software development and security analysis, as evidenced by high scores on benchmarks like SWE-bench Pro and Terminal-Bench 2.0.
• Scalability: Capable of analyzing vast amounts of code and identifying vulnerabilities at a scale previously unattainable.

Examples of Claude Mythos Preview's Discoveries:

• OpenBSD Vulnerability: Discovered a 27-year-old vulnerability in OpenBSD, an operating system known for its robust security, allowing remote system crashes.
• FFmpeg Vulnerability: Identified a 16-year-old flaw in FFmpeg, a widely used multimedia framework, which had been missed by millions of automated tests.
• Linux Kernel Exploits: Found and chained multiple vulnerabilities in the Linux kernel, enabling privilege escalation from user access to full system control.

These findings underscore the transformative potential of AI in cybersecurity, both for offense and defense. Project Glasswing aims to channel this potential towards defensive applications.

Project Glasswing: A Collaborative Defense Strategy

Project Glasswing is built on the principle of collective action. Recognizing that no single entity can tackle the complex challenges of AI-driven cybersecurity alone, the initiative brings together a diverse group of industry leaders. The core objectives include:

1. Leveraging AI for Defense: Providing partners with access to Claude Mythos Preview to enhance their defensive security efforts, including vulnerability detection, black box testing, endpoint security, and penetration testing.
2. Sharing Knowledge: Anthropic commits to sharing learnings from this initiative to benefit the broader industry.
3. Supporting Open Source: Recognizing the critical role of open-source software, Anthropic is donating significant funds to organizations like Alpha-Omega, OpenSSF, and the Apache Software Foundation to bolster the security of open-source projects.
4. Broad Access: Extending access to Claude Mythos Preview to over 40 additional organizations maintaining critical software infrastructure.
5. Developing Safeguards: Working towards developing robust AI safeguards that can detect and mitigate the risks associated with advanced AI models, with plans to integrate these into future Anthropic models.

Commitments and Support:

• $100 Million in Model Usage Credits: Anthropic is dedicating substantial resources to ensure broad access and usage of Claude Mythos Preview for Project Glasswing participants.
• $4 Million in Direct Donations: Funding allocated to open-source security organizations to strengthen the ecosystem.
• Industry Collaboration: Fostering partnerships to share best practices and develop industry-wide recommendations for AI-era cybersecurity.

The Future of Cybersecurity in the AI Era

The landscape of cybersecurity is undergoing a fundamental transformation driven by the rapid advancement of AI. Project Glasswing is a critical step in navigating this new era. By proactively addressing the risks and harnessing the defensive potential of AI, the initiative aims to:

• Shift the Balance: Empower defenders with AI-driven tools to stay ahead of evolving threats.
• Enhance Software Security: Improve the security posture of critical software through advanced vulnerability discovery and remediation.
• Promote Collaboration: Foster a collaborative ecosystem where industry players, researchers, and governments work together to secure digital infrastructure.
• Set Industry Standards: Contribute to the development of best practices and recommendations for AI-driven cybersecurity.

Anthropic is committed to working closely with government officials and industry partners to ensure that AI development proceeds safely and responsibly, with a strong emphasis on security and societal benefit. Project Glasswing is not just a project; it's a call to action for the entire technology community to unite in building a more secure digital future.