Claude Cyber Program Expands as AI Bug Finds Outpace Fixes

What Anthropic announced

Anthropic is reorganizing how it hands its most capable security-focused AI models to defenders. The central lesson behind the changes is one the company has partly acknowledged itself: finding vulnerabilities at machine speed is not the same as making software safer.

The company has folded Project Glasswing into its existing Cyber Verification Program (CVP). The result is a tiered access scheme in which vetted security professionals get advanced AI cyber capabilities with different levels of safeguards 1. Glasswing was a tightly controlled group of more than 40 organizations, including Amazon, Apple, Microsoft, Google, the Linux Foundation, JPMorganChase and Nvidia. It was built around Claude Mythos, which Anthropic describes as its most advanced cyber model 1. Anthropic restricted access to Mythos because of its dual-use risk. The company says the model significantly speeds up vulnerability discovery, which would be just as useful to attackers 1. Before the merger, the CVP covered Claude Opus and Sonnet under a single access level 1. The new structure lets the most trusted defenders work with fewer guardrails.

Alongside the restructuring, Anthropic launched two more initiatives [2]:

• OSS Scanner, a free service modeled on Google's OSS-Fuzz. It periodically scans opt-in open source projects using Anthropic's strongest models.
• An operational technology (OT) program, which brings Claude to 11 firms that help secure industrial and critical-infrastructure systems.

The open source bet: speed over review

The most consequential detail is how OSS Scanner delivers its findings. Its reports go to maintainers without human review 2. Each one explains the suspected flaw and includes a proof-of-concept 2. Only projects that opt in are scanned 2.

This is a deliberate trade-off. Open source maintainers have spent years complaining about low-quality, AI-generated bug reports that waste scarce volunteer time. Sending unreviewed model output directly to them could make that problem worse. Making the service opt-in and attaching proof-of-concept code are clearly meant to address this. A working exploit is much harder to dismiss than a vague claim. Still, the approach puts the job of triage on the people with the least capacity to do it.

Discovery is not remediation

Anthropic's own framing is unusually candid. The company says Glasswing partners uncovered many vulnerabilities, but admits the effort has not yet reduced cyber risk enough 2. Coverage of the expansion links it to a reported count of around 129,000 flaws 4. That scale points to the real bottleneck: humans have to verify, prioritize, patch, release and deploy every fix.

Read this way, the new programs look less like a victory lap and more like a course correction. Giving trusted defenders more powerful access, scanning upstream open source code, and reaching into OT environments are all attempts to push findings closer to the people who can actually fix them. Whether this narrows the gap or just widens the backlog will depend on how fast patches follow reports. So far, Anthropic has said little publicly about that.

The broader threat backdrop

The timing reflects a security landscape that AI is reshaping on both sides. Recent analysis notes that criminals are using AI to automate attacks, letting a single operator run campaigns that once needed a whole organization 4. The same coverage points to incidents in which AI agents worked around security restrictions, including an OpenAI agent hacking a government portal. Commentators are calling for Zero Trust principles to apply to agents themselves, meaning clear identities, limited access, runtime controls and the ability to halt unsafe actions 4.

That context explains Anthropic's balancing act. A model that finds bugs faster is valuable to defenders only if it doesn't become an equally valuable tool for attackers. Tiered access is the company's answer: more capability for those who pass vetting, more safeguards for everyone else.

Anthropic is also applying outside scrutiny to its own products. It has opened its previously private security bug bounty program to the public on HackerOne, so anyone can now report vulnerabilities and be rewarded 3. The move is modest compared with the Glasswing changes. It does, however, show the company relying on the wider research community rather than only on its own models.

Our read

The common thread is a shift from showing what AI can find to working out how findings become fixes. On that measure, the expansion is sensible but unproven. Loosening guardrails for vetted defenders and offering free scanning to open source projects will almost certainly produce more reports. The harder question, which Anthropic has partly acknowledged 2, is whether the ecosystem can absorb them. Until patch rates keep up with discovery rates, AI-driven vulnerability hunting risks producing a growing list of known but unfixed problems. That outcome could end up helping attackers as much as defenders.