The landscape just shifted
On April 7, 2026, Anthropic announced Project Glasswing — a $100 million initiative to use AI to find and fix vulnerabilities in critical software. The centerpiece: Claude Mythos, an AI model that has already discovered thousands of zero-day vulnerabilities in "every major operating system and web browser," including bugs that survived decades of human review and millions of automated security tests.
The partners read like a who's-who of cybersecurity: CrowdStrike, Palo Alto Networks, Microsoft, AWS, Apple, Google, Cisco, NVIDIA, JPMorgan Chase, and the Linux Foundation.
This isn't theoretical. These vulnerabilities are real, they're being responsibly disclosed, and patches will follow. For every security leader, vCISO, and MSP managing client environments, this changes the game.
What's actually happening
The AI model: Claude Mythos Preview is a frontier AI with coding capabilities that surpass humans at finding and exploiting software vulnerabilities. Anthropic is deliberately NOT making it generally available — only ~40 organizations with responsibility for critical infrastructure get access.
The output: Thousands of zero-day vulnerabilities across every major platform. These will flow through responsible disclosure to vendors, who will issue patches. Those patches flow through your vulnerability scanners (Tenable, Qualys, Rapid7), your endpoint platforms (CrowdStrike, SentinelOne), and your cloud security tools (AWS Security Hub, Azure Defender).
The timeline: Expect a significant uptick in CVE publications and emergency patches over the coming months as Glasswing findings are disclosed and remediated.
What this means for your security program
1. Patching urgency is about to spike
When Glasswing findings start flowing as CVEs, the volume of critical patches will increase substantially. Organizations with poor patch management will be exposed.
What to do now:
- Verify your vulnerability management program has automated scanning on at least a weekly cadence
- Ensure your patching SLAs are defined and enforced: critical within 72 hours, high within 14 days
- If you're using Tenable, CrowdStrike, or other tools with Radius360 deep integrations, these findings will automatically surface as risks with mitigation tasks
- Brief your clients: "A wave of new vulnerability disclosures is coming. Our scanning and patching process will handle it, and here's how we'll report on it."
2. Risk registers need an AI-discovered vulnerability category
This is a new class of risk. AI-discovered vulnerabilities are different from traditional CVEs in important ways:
- They were missed by decades of human review — these are deep, structural bugs
- They may be harder to patch — some may require architectural changes, not just code fixes
- The disclosure cadence will be faster — AI finds them in hours, not months
- Adversaries will develop similar capabilities — if Anthropic can find them, so can nation-state actors
Your risk register should track these separately so you can report on:
- How many AI-discovered CVEs affect your environment
- Time to remediate vs. traditional CVEs
- Which systems are most exposed
3. Compliance frameworks will evolve
Every major framework will need to address AI-powered vulnerability discovery:
| Framework | Expected Impact |
|---|---|
| NIST CSF | DE.CM (Continuous Monitoring) and RS.MI (Mitigation) controls will need to account for AI-accelerated disclosure timelines |
| SOC 2 | CC7.1 (Detection) and CC7.4 (Remediation) — auditors will ask how you handle high-volume CVE waves |
| ISO 27001 | A.12.6 (Technical Vulnerability Management) — expect updated guidance on AI-discovered vulnerabilities |
| CMMC | SI.L2-3.14.1 (Flaw Remediation) — defense contractors will face accelerated patching requirements |
| Cyber Insurance | Carriers will update underwriting to verify AI-era patching capabilities |
4. Your integrations become more valuable
If you're running CrowdStrike, Tenable, SentinelOne, or any Glasswing partner product, you're already in the pipeline. When these tools receive Glasswing-derived detections:
- CrowdStrike will push new detection rules for exploits targeting Glasswing-discovered vulns
- Tenable/Qualys will add plugin checks for new CVEs as they're published
- Microsoft Defender/Sentinel will update detection signatures
With deep integrations that auto-generate risks and mitigation tasks, these findings flow directly into your risk register, create investigation tasks, and map to framework controls — automatically. No manual triage.
5. Board conversations are changing
When the board reads about Project Glasswing in the Wall Street Journal (and they will), they'll ask: "Are we affected? What are we doing about it?"
Your answer should be:
- "We monitor for these vulnerabilities through our scanning and endpoint tools."
- "When Glasswing-discovered CVEs are published, they'll appear in our risk register within hours."
- "Our patching SLAs ensure critical vulnerabilities are remediated within 72 hours."
- "Here's our posture report showing current vulnerability status."
This is exactly the kind of conversation a vCISO is built for — translating technical developments into business risk language for leadership.
What MSPs and MSSPs should do
If you manage client environments, Glasswing is both a risk and an opportunity.
The risk: Clients who don't patch quickly will be exposed as AI-discovered vulnerabilities are disclosed. If you're not scanning weekly and patching aggressively, you're falling behind.
The opportunity: This is a forcing function for clients who've been deferring security investment. "AI is now discovering vulnerabilities faster than humans can" is a compelling reason to:
- Upgrade from quarterly to weekly vulnerability scanning
- Deploy EDR on all endpoints (not just workstations)
- Invest in a GRC platform for risk tracking and compliance
- Engage a vCISO for strategic guidance
For MSPs making the transition to MSSP, Glasswing accelerates the timeline. Clients who were on the fence about security services will feel the urgency.
The AI governance angle
There's a meta-question here that your organization needs to address: how do you govern AI use in your own security program?
If you're using AI-powered tools for vulnerability scanning, threat detection, or compliance assessment, those tools need governance:
- What AI models power your security tools?
- What data do they access?
- How are findings validated before action is taken?
- What's your policy on AI-generated security recommendations?
This is where AI governance frameworks come in — EU AI Act, NIST AI RMF, and ISO 42001 all have requirements for organizations deploying AI systems, including in cybersecurity.
Bottom line
Project Glasswing marks the beginning of the AI-driven vulnerability era. The defensive potential is enormous — thousands of critical bugs found and fixed before adversaries exploit them. But it also means:
- Patching volume will increase significantly
- Risk registers need to track AI-discovered vulnerabilities as a category
- Compliance frameworks will update to address accelerated disclosure
- Board and insurance conversations will reference AI-powered threats
- MSPs who can manage this transition will differentiate from those who can't
The organizations that prepare now — with automated scanning, risk-aware integrations, and strong patch management — will handle the wave. The ones who wait will scramble.
Need help preparing your security program for the AI vulnerability era? BlueRadius helps MSPs and vCISOs build resilient security operations. Pair it with Radius360 for automated risk tracking and evidence collection across all your clients.
