Anthropic just built an AI that found a 27-year-old vulnerability in OpenBSD.
It wasn’t a team of researchers. Or a red team. It was one model. Autonomously.
That’s Project Glasswing. And it changes the math on cybersecurity entirely.
Here’s what happened.
Anthropic trained a new model, called Claude. It’s not public. Probably never will be.
Over the past few weeks, Claude found thousands of zero-day vulnerabilities across every major OS and browser. Some of the bugs had survived decades of human review and millions of automated scans.
A 27-year-old flaw in OpenBSD — one of the most hardened operating systems on earth.
A 16-year-old bug in FFmpeg that automated tools had hit five million times and never caught.
Multiple Linux kernel vulnerabilities chained together to give an attacker full root access.
All found autonomously. No human steering.
The bizarre part?
They aren’t worried about an attacker getting their hands on it. They’re terrified of themselves.
That’s why they’re not releasing it. Instead, they’ve locked it behind Project Glasswing — a coalition with AWS, Apple, Cisco, CrowdStrike, Google, JPMorgan, Microsoft, NVIDIA, and others — and are using Claude exclusively for defense.
$100M in usage credits committed. $4M donated to open-source security foundations.
This is not a product launch. This is a controlled detonation.
Here’s what that means for the industry.
The window between “vulnerability discovered” and “vulnerability exploited” just shrank.
Pre-AI, that window was weeks, sometimes months. Skilled researchers discover a bug, write a CVE, vendor patches it, most orgs eventually apply the fix.
That pipeline assumed scarcity of expertise. One of the cleverest people in the world might be able to find a Linux kernel zero-day.
Now one model can find thousands.
The CVE triage pipeline breaks. The patching cadence breaks. The entire assumption that “the defender has more time than the attacker” breaks.
Cybersecurity stocks already reacted. Cloudflare, Okta, CrowdStrike — all down on the announcement.
CrowdStrike is literally a Project Glasswing founding member. And investors still sold off. Because the market understands something the press release doesn’t say out loud:
If AI can find every bug in your stack, what exactly are you paying a security vendor for?
The honest answer is: execution and response. Finding bugs is table stakes now. Can you fix them fast?
Which is where this gets messy.
Open source maintainer — the actual humans who maintain FFmpeg, OpenBSD, the Linux kernel — have historically been underfunded, understaffed, under-resourced, and underappreciated.
Claude can now hand them a list of 10,000 vulnerabilities.
Who is patching 10,000 vulnerabilities?
Anthropic is donating $2.5M to Linux Foundation and OpenSSF. That’s meaningful but it’s not a structural fix to the open source maintenance problem.
The real question isn’t “can AIs find bugs.” Claude proved yes.
The real question is: does your org have the engineering bandwidth to act on what Claude finds?
Most don’t.
That’s the awkward truth hiding inside the Glasswing press release.
The capability is here. The operational readiness isn’t.
Is your team actually ready for a world where an AI can generate a zero-day faster than you can ship a patch?
Is your team actually prepared for a world where AI can generate a zero-day faster than you can ship a patch?
👇
Top comments (0)