Anthropic’s new AI just found 10,000 ways to break the internet
Anthropic just dropped an update on Project Glasswing, and if you’re a developer responsible for critical infrastructure, you might want to double-check your caffeine supply. In just one month, their new "Mythos Preview" model sniffed out over 10,000 high- or critical-severity vulnerabilities across the world’s most systemically important software. We’re talking about the digital load-bearing walls of the internet—Cloudflare, Mozilla, and Palo Alto Networks.
It’s a "good news, bad news" situation of the highest order. The good news is that we’re finally shining a high-powered flashlight into the dusty corners of code that have been vulnerable for years. The bad news? Human beings are officially the bottleneck. Anthropic admits that software security used to be limited by how fast we could find flaws, but now we’re drowning in them.
The report highlights a growing frustration among open-source maintainers, who are often volunteers working for the love of the craft. Some have actually begged Anthropic to slow down the rate of disclosures because they simply don't have the "human capacity" to triage and patch the deluge of AI-generated bug reports. When a high-severity bug takes two weeks to patch on average, a 10x increase in findings is a recipe for a total system meltdown.
This creates a terrifying "interim period" where AI can find vulnerabilities faster than we can fix them. Anthropic is keeping Mythos behind a velvet rope for now, fearing that releasing a model this capable without "far stronger safeguards" would be like handing a skeleton key to every digital burglar on the planet. To bridge the gap, they’re pushing "Claude Security" to enterprise users to help them automate the fixes, but the open-source world is still playing catch-up.
On the safety front, Anthropic is trying to make their models less of a moralizing headache with "Constitutional Classifiers++." The previous version was a bit of a resource hog, adding a 23% compute overhead and constantly refusing harmless questions. The new "++" version uses a two-stage "cascade architecture" that reuses the model’s internal activations—basically checking Claude’s "gut intuition" to see if a query is actually malicious.
This new "gut check" is a win for anyone tired of AI lectures. It cut compute costs down to a 1% overhead and slashed the refusal rate on harmless queries by 87%. Anthropic claims no one has found a "universal jailbreak" for this new system yet, though they admit they’re still vulnerable to "reconstruction attacks" where hackers hide malicious code inside benign-looking puzzles.
The takeaway here is simple: Only time will tell how fast your favorite software will get hit. We’re in a race where the AI is running a marathon and human developers are still trying to find their running shoes. If we don’t automate the patching process as fast as we’ve automated the hacking, the "most systemically important software in the world" is going to look like a Swiss cheese factory very soon.
Sources: Project Glasswing Update, Next-gen Constitutional Classifiers.
