AI-Assisted Vulnerability Discovery Reshaping CVE Disclosure Volumes; Anthropic's Glasswing Sets Industry in Motion

Summary

In April 2026, Anthropic announced Project Glasswing and Claude Mythos Preview, a restricted-access AI model designed for vulnerability discovery. The company claimed Mythos had already identified thousands of zero-day vulnerabilities across major operating systems and web browsers, with access funneled to a coalition of major tech and security partners including AWS, Apple, Microsoft, Google, and Palo Alto Networks. The announcement marked a significant inflection point in AI-assisted security research.

Since the Glasswing announcement, CVE disclosure volumes have surged dramatically across the industry. Chrome CVEs are up 563.2% year-to-date, GitHub repositories up 476.07%, VMware up 180.9%, Apache up 170.3%, Mozilla up 156.9%, HPE up 132.3%, and F5 up 113.8%. While not all increases can be directly attributed to AI, the timing and magnitude of the increases suggest widespread adoption of AI models for vulnerability discovery is already reshaping disclosure patterns.

Analysis from security researchers indicates the trend is real but emerging, with evidence from Mozilla, Microsoft, Apache, Curl, and Palo Alto showing AI models being deployed to find, validate, and triage vulnerabilities. The quality of vulnerability submissions has improved alongside the volume increase, suggesting frontier AI models are delivering actionable results rather than noise.

The critical open question is sustainability. Defenders face a new operating environment with sharply elevated vulnerability volumes and must prioritize threat intelligence to focus on vulnerabilities being actively exploited while preparing for what may be a sustained shift in disclosure patterns.

• Defenders must prepare for sustained higher vulnerability volumes while using threat intelligence to prioritize vulnerabilities being actively exploited or likely to be targeted

Editorial Opinion

Anthropic's Glasswing announcement crystallizes a trend that was already emerging in disclosure volumes—frontier AI models are now capable of finding security vulnerabilities at scale. The restricted access model is a reasonable interim approach, but it also creates a disclosure asymmetry where major tech companies have access to Mythos while the broader security community operates in the dark. If AI-assisted vulnerability discovery becomes standard practice, the industry faces a critical inflection point: either CVE volumes stabilize at a higher baseline as defenders catch up, or continuous model improvements sustain exponential growth, fundamentally reshaping how security teams operate.