Anthropic just turned a tightly held US/UK security preview into a 15-country program, and the named entrants now include the companies that build the chips and identity layers under much of the internet.
What Changed: Glasswing's Scope After the Expansion
On June 2, 2026, Anthropic added roughly 150 organizations to Project Glasswing, its restricted defensive-security program built around the Claude Mythos Preview model, quadrupling the cohort from about 50 initial participants to around 200 across more than 15 countries . The expansion's headline is reach: a launch cohort concentrated in the US and UK now spans Five Eyes and beyond.
Reported new geographies include Canada, Australia, New Zealand, France, Germany, Italy, Switzerland, the Netherlands, Spain, Belgium, Sweden, India, Japan, and South Korea . That spread matters for developers: vulnerability disclosure now routes through partners under more than a dozen national jurisdictions, each with its own coordinated-disclosure norms.
Named expansion entrants reported so far include Okta, Samsung, SK Hynix, SK Telecom, and Intercontinental Exchange . The caveat: Anthropic has not published a complete official roster, so the list of who actually holds Mythos access is partly assembled from press reporting, not a vendor manifest.
Admission is not open. Anthropic frames eligibility around systemic blast radius, stating that for most partners:
"For most partners, we estimate that a major attack could affect more than 100 million people, with important ramifications for both global and national security," — Anthropic, Project Glasswing announcement (source: Anthropic).
The practical read for technical founders: this is still a closed preview gated on security posture, not a product you can sign up for. Anthropic has said it expects to bring Mythos-class models to all customers "in the coming weeks," contingent on stronger anti-misuse safeguards — but for now, the expansion widens the circle without opening the door.
The 10,000-Flaw Tally: What the Frontline Found
Glasswing partners collectively surfaced more than 10,000 high- or critical-severity flaws during the program's first phase — roughly two months of scanning . That number is self-reported by Anthropic and its partners, not independently audited, so treat it as a directional signal of what frontier code-scanning produces at scale rather than a settled count.
The named examples are the more verifiable part. Anthropic's Frontier Red Team says Mythos Preview found a 27-year-old OpenBSD vulnerability, a 16-year-old FFmpeg bug, and a FreeBSD NFS-server remote-code-execution issue tracked as CVE-2026-4747, alongside Linux local privilege-escalation chains, browser exploit chains, and cryptography weaknesses . These span every major operating system and web browser — the kind of long-dormant defects that have survived decades of human review.
On benchmarks, the gap over the prior generation is the headline. Note the caveat for each: CyberGym is Anthropic's own eval, while SWE-bench Verified has an independent public leaderboard you can check against the vendor claim.
| Benchmark | Mythos Preview | Claude Opus 4.6 | Independent? |
|---|---|---|---|
| SWE-bench Verified | 93.9% | 80.8% | Public leaderboard |
| CyberGym | 83.1% | 66.6% | Anthropic's own eval |
| SWE-bench Pro | 77.8% | 53.4% | Public leaderboard |
| Humanity's Last Exam (no tools) | 56.8% | 40.0% | Independent |
Source: Anthropic's Mythos figures via CyberScoop . The CyberGym jump is the one to discount most, since the same vendor builds the model and the test.
Severity scoring held up better than raw flaw counts under scrutiny. Across 198 manually reviewed reports, expert validators matched Claude's severity assessment exactly 89% of the time and landed within one severity level 98% of the time . That suggests the model's triage is roughly aligned with human experts on the sample it was checked against.
Here is the caveat that should temper every number above: fewer than 1% of the findings were fully remediated at publication, with more than 99% still in coordinated disclosure . Until patches and technical details go public, the 10,000-flaw tally stays only partially verifiable — confirmed in headline cases like OpenBSD, unaudited in aggregate.
Sector Diversification: Power, Healthcare, and Telecom Join the Cohort
The April 7, 2026 launch cohort was lopsided: roughly 50 organizations, concentrated in the US and UK and skewed heavily toward software vendors and platform operators . The June 2 expansion was a deliberate correction. Anthropic added the sectors that run physical infrastructure and were largely absent at launch — the targets where a breach has kinetic, not just data, consequences .
The newly admitted categories cover the systems most people never think about until they fail:
- Power and energy — grid operators and utilities
- Water — treatment and distribution systems
- Healthcare — providers and connected medical infrastructure
- Communications / telecommunications — carrier-grade networks
- Hardware manufacturing — chip and device makers
- Critical software maintainers, including nonprofits and open-source projects
That last category is the one with the sharpest economics. Most maintainers of critical open-source libraries operate on volunteer time and donated hosting, with no budget for frontier-grade vulnerability scanning. The Linux Foundation framed Glasswing access as removing that barrier directly.
"Project Glasswing gives maintainers of critical open-source projects free access to advanced AI tooling to secure their code, lowering the cost barriers that have kept high-end security out of reach," — the Linux Foundation (source: Linux Foundation).
Anthropic backed that framing with cash, separate from the $100 million Mythos usage-credit pool. A distinct $4 million in donations went to open-source security groups, split as follows:
| Recipient | Channel | Amount |
|---|---|---|
| Alpha-Omega / OpenSSF | via the Linux Foundation | $2.5M |
| Apache Software Foundation | direct | $1.5M |
| Total open-source donations | — | $4M |
The donation figures and the $100 million credit pool are both reported by CyberScoop . Funding maintainers matters because the open-source libraries they steward sit underneath the same power, telecom, and healthcare stacks now joining the program — the FFmpeg-class dependencies where a single unpatched flaw propagates everywhere.
NATO, ENISA, and the Geopolitical Layer of Glasswing
The expansion pulls Glasswing into alliance and government territory, not just corporate codebases. The EU cybersecurity agency ENISA was reported as admitted to the program, and Spanish outlets El País and Cadena SER additionally reported NATO gaining access . Anthropic's own announcement does not name NATO, so treat that admission as press-reported rather than vendor-confirmed .
Geographically, the June 2 expansion completes a recognizable security footprint. The Five Eyes intelligence alliance is now fully represented: Canada, Australia, and New Zealand join the existing US and UK presence .
The continental European and Asian cohorts fill in the rest of the 15-plus-country map:
- Continental Europe: France, Germany, Italy, Switzerland, the Netherlands, Spain, Belgium, and Sweden reported as new geographies .
- Asia: India, Japan, and South Korea, with Samsung and SK Hynix/SK Telecom reported as named participants anchoring the Korean presence .
What none of the reporting clarifies is how a defensive intelligence agency or a transnational alliance actually uses Mythos Preview. The same scan-and-patch workflow makes sense for a vendor hardening its own repositories; it is far less obvious for ENISA or NATO, whose mandates span coordination, advisory work, and member-state infrastructure they do not directly own.
Anthropic has not specified whether that access is operational, advisory, or scoped to particular codebase types, nor disclosed the legal and operational terms governing it . For a program built on coordinated disclosure, the question of who controls vulnerability findings once a national-security body is in the loop is the part still left open.
Entry Criteria and Economics: When Broader Admission Happens
Admission to Glasswing turns on a gate Anthropic has not described in public. New entrants must meet Anthropic's security requirements before gaining Mythos Preview access , but no technical, compliance, or audit standard has been specified. There is no published bar — SOC 2 tier, encryption posture, disclosure-handling policy — that an organization can read and self-assess against before applying.
The economics are clearer than the criteria. During the program, Anthropic committed up to $100 million in Mythos usage credits to Glasswing participants . Once that research-preview window closes, listed participant pricing is $25 per million input tokens and $125 per million output tokens . Access runs through four channels:
- The Claude API (direct)
- Amazon Bedrock — with gated preview access and controls like customer-managed encryption, VPC isolation, and detailed logging
- Google Cloud Vertex AI — in private preview for selected customers
- Microsoft Foundry
On timing, Anthropic says it expects to bring Mythos-class models to all customers "in the coming weeks," contingent on adding "robust safeguards" against malicious misuse . What those safeguards are, and the concrete release date, are not specified — the same dual-use logic that justifies keeping a vulnerability-finding model closed also leaves the unlock conditions undefined.
The long-term direction, at least, is stated plainly. Anthropic projects that "hundreds of thousands of organizations, researchers, and maintainers will likely need access" over time — a path from roughly 200 vetted partners toward broad availability. For developers, the practical read is this: the pricing is public and the channels are familiar, but admission today is a relationship, not a checkout flow, and the timeline to general access is a promise rather than a date.
Opacity in the Expansion: Unverified Rosters, Unpublished Safeguards
Glasswing's June growth is real, but most of its specifics are still secondhand. Anthropic has not published an official roster for the expansion, so every named new participant — Okta, Samsung, SK Hynix, SK Telecom, Intercontinental Exchange, and the reported NATO and ENISA access — traces to third-party reporting rather than Anthropic's own announcement . For developers tracking who actually holds Mythos Preview, that gap matters: the headline names are journalism, not a vendor manifest.
The headline numbers carry the same caveat. The more than 10,000 high- or critical-severity flaws surfaced in the first phase is self-reported, and Anthropic acknowledged that fewer than 1% were fully patched at publication because over 99% remained in coordinated disclosure . Independent quality verification is therefore not possible today — the details stay sealed until patches ship.
Two more unknowns shape the timeline:
- Undefined safeguards. Anthropic ties general availability to "robust safeguards" against misuse but has published no technical, legal, or audit specification, so no one outside the program can gauge how close that threshold is .
- A reporting window, not a date. Anthropic committed to a public report on lessons learned and discloseable fixes within 90 days of the April 7, 2026 launch — pushing the earliest independently checkable disclosures into roughly July 2026 .
The concrete takeaway: treat the scope and tooling as confirmed, but treat the flaw count, the partner list, and the safeguard timeline as claims awaiting evidence. The first real audit moment is that 90-day report. Until coordinated disclosure unwinds and that document lands, the prudent stance is to watch the patches, not the press coverage.
Frequently asked questions
What is Project Glasswing?
Project Glasswing is Anthropic's restricted, defensive-cybersecurity program that gives vetted critical-infrastructure organizations access to Claude Mythos Preview for scanning codebases, detecting vulnerabilities, and writing patches. It is not a safety fellowship — it is a collaborative vulnerability-detection initiative aimed at hardening defenders before frontier AI cyber capabilities proliferate. It launched on April 7, 2026 with roughly 50 organizations , then expanded on June 2, 2026 to about 200 organizations across more than 15 countries .
Which organizations qualify for Glasswing admission?
Glasswing targets organizations whose compromise could affect large populations — Anthropic estimates a major attack on most partners could affect more than 100 million people . Eligible entities include critical open-source software maintainers, power, water, healthcare, telecom and hardware operators, and major cloud and financial infrastructure providers. Beyond sector fit, applicants must also meet Anthropic's undisclosed security requirements before they gain access .
When will Claude Mythos Preview be generally available?
Anthropic said it expects to bring Mythos-class models to all customers "in the coming weeks," contingent on adding "robust safeguards" against malicious misuse . No firm date or concrete safeguard specification has been published. After research-preview credits, listed participant pricing is $25 per million input tokens and $125 per million output tokens , available through the Claude API, Amazon Bedrock, Google Cloud Vertex AI, and Microsoft Foundry.
How reliable is the 10,000-vulnerability count?
The figure of more than 10,000 high- or critical-severity flaws surfaced in the program's first phase is self-reported by Anthropic and not independently audited . In 198 manually reviewed reports, expert validators matched Claude's severity assessment exactly 89% of the time and were within one level 98% of the time . With more than 99% of findings still in coordinated disclosure, independent verification of quality is not yet possible until patches and details become public.
Does NATO actually have access to Claude Mythos Preview through Glasswing?
NATO access has been reported by El País and Cadena SER, but Anthropic has not confirmed it in its official expansion announcement . EU cybersecurity agency ENISA admission is likewise third-party reported rather than officially confirmed . The legal and operational terms governing any NATO or government-body use remain publicly unspecified.
