Project Glasswing Explained: AI Security Help for Open Source Maintainers

Project Glasswing is an Anthropic program, launched on 7 April 2026 with the Linux Foundation among its launch partners, that gives organizations maintaining critical software access to Claude Mythos Preview, an unreleased model, to find and fix vulnerabilities. Open source maintainers get funded triage help, free Claude subscriptions, reviewed disclosures and an opt in scanner. Downstream users should expect more patches, faster.

That is the short version. The longer version matters more, because Glasswing changed shape several times in six months. This guide walks through what Anthropic and the Linux Foundation have actually published, what it means if you maintain a project, what it means if you only consume open source, and which questions are still open.

Key takeaways

• What it is: an Anthropic led effort to use an unreleased model, Claude Mythos Preview, for defensive security on software much of the world depends on. Anthropic says it does not plan to make Mythos Preview generally available.
• Who was in it: twelve launch organizations including Anthropic and the Linux Foundation, more than 40 other critical software organizations, and about 150 more added in June 2026.
• Money: up to $100M in usage credits, plus $4M in donations: $2.5M to Alpha-Omega and OpenSSF through the Linux Foundation and $1.5M to the Apache Software Foundation.
• What maintainers get: not a Mythos login by default. The open source routes are human reviewed disclosures, free Claude Max 20x through Claude for Open Source, funded triage through foundations, and since 8 October 2026 an opt in scanner that sends unreviewed reports with candidate patches.
• Where it stands: in October 2026 Anthropic moved Glasswing members into the top tier of its expanded Cyber Verification Program and described Glasswing as merged into it.
• The bottleneck: by Anthropic's own account, finding bugs is no longer the slow part. Verifying, patching and deploying is.
• Downstream: expect bigger patch batches and less time between a fix and an exploit. Know what you ship and treat security bumps as urgent.

What Project Glasswing is

Project Glasswing is a defensive security program run by Anthropic. It was announced on 7 April 2026, the same day Anthropic described a new model, Claude Mythos Preview, which it calls a general purpose, unreleased frontier model. Anthropic says the model can find and exploit software vulnerabilities at a level only highly skilled people could match before, so instead of releasing it widely, it gave it to a limited set of organizations that maintain important software, for defensive use.

The name comes from the glasswing butterfly, Greta oto. Anthropic's announcement explains the metaphor two ways: transparent wings let the insect hide in plain sight, like long lived bugs in well reviewed code, and transparency is also what Anthropic says it is aiming for in how it runs the program.

The Linux Foundation published its own announcement the same day, written by its CEO, Jim Zemlin. It frames Glasswing around maintainers, who face more pull requests and bug reports, many AI generated, plus more attacks and supply chain campaigns. Zemlin's post puts the core worry bluntly: "the dark side of AI-augmented security is AI-augmented insecurity." His argument is that if capable AI security tools are only available to well funded organizations, volunteer maintainers fall further behind, so access for them has to be free.

Who runs it

Anthropic runs Glasswing. It chooses partners, sets their security requirements, funds model usage through credits and runs disclosure for bugs its own teams find. The Linux Foundation is a launch partner, not an operator. Its role, as described by both organizations, is to channel funding and support to maintainers through its security initiatives, Alpha-Omega and the Open Source Security Foundation (OpenSSF).

Who the partners are

Anthropic's launch announcement lists twelve organizations including itself. Summarized by type, they are: Anthropic; the Linux Foundation; three major cloud providers; a consumer device maker; two chip and infrastructure software companies; a large US bank; and three companies whose main business is network or endpoint security.

Beyond the launch twelve, Anthropic said it extended access to over 40 additional organizations that build or maintain critical software infrastructure, so they could scan both their own code and open source systems. Its 22 May update describes the group as about 50 partners in total. On 2 June Anthropic added roughly 150 more organizations, based in more than 15 countries and covering sectors the first group lacked: power, water, healthcare, communications and hardware. Each had to meet Anthropic's security requirements first.

What the partners were asked to do

The April announcement says partners would use Mythos Preview to find and fix weaknesses in their foundational systems. Anthropic expected the work to focus on local vulnerability detection, black box testing of binaries, securing endpoints and penetration testing. Anthropic promised a public report within 90 days and delivered an initial update on 22 May.

Timeline: how Glasswing changed between March and October 2026

What maintainers actually get access to

This is where most coverage gets loose. The Linux Foundation post says Glasswing is designed so that maintainers get access to these tools for free. Anthropic's pages describe several separate routes, and none of them is "every maintainer gets a Mythos Preview account". Here is what each route offers, according to Anthropic's own pages.

Claude for Open Source eligibility

Anthropic's Glasswing announcement tells maintainers who want access to apply through Claude for Open Source. That program's page offers six months of free Claude Max 20x to maintainers of packages with 500 or more dependent repositories, 100 or more dependent packages or 200,000 or more monthly downloads; to listed committers on recognized foundation and language projects; to contributors with 100 or more merged pull requests to other people's repositories in a year; to owners of repositories with 20 or more external contributors in a year; and to maintainers of any repository with an OpenSSF criticality score of 0.4 or above. People who maintain something the ecosystem quietly depends on are invited to apply anyway. One thing the page does not say is that Claude for Open Source includes Mythos Preview or Mythos 5.1. We could not confirm that it does, so do not assume a free subscription gives you the same model the launch partners used.

OSS Scanner: the opt in fast track

OSS Scanner, launched on 8 October 2026, answers maintainers who asked Anthropic to send everything, not just verified bugs. Anthropic says it had found over 29,000 candidate vulnerabilities in six months but manually reviewed only about 6,000, and had already sent nearly 5,000 unverified reports on request.

The scanner's FAQ sets out the rules:

• Eligibility follows criteria similar to OSS-Fuzz: established projects with critical impact on infrastructure and user security, judged case by case. Factors include exposure to remote attack, dependents, update frequency and OpenSSF criticality score. Brand new projects and most forks do not qualify.
• Enrollment is a pull request to the anthropics/oss-scanner repository on GitHub that adds a project.yaml file. Required fields are the repository URL, a primary contact address and a Dockerfile that builds the project. Optional fields include extra addresses to copy, a homepage, a threat model file, a PGP key for encrypted reports and a flag to pause reports.
• The scan runs offline. The Dockerfile is built with network access, then the scanning agents run with internet access disabled inside hardened sandboxes.
• Reports are model generated and not reviewed by a human. Each includes a self contained reproducer, an explanation, a bisection to find when the bug was introduced where possible, and a candidate patch when available.
• No disclosure clock is placed on these unvalidated findings. If Anthropic later validates one through its normal process, the 90 day clock starts when the maintainer is told a human has validated it.
• Opting out is a pull request that sets the pause flag or deletes the project directory. You then fall back to normal human reviewed disclosures.

Anthropic is candid that unreviewed reports will sometimes be wrong. In its validation of an early version, expert reviewers checked 97 critical and high findings across 48 projects: 85 met the bar for its disclosure process, 11 were real but duplicates, and one was invalid. Maintainers have told Anthropic that severity ratings can be inflated and that the scanner sometimes misunderstands a project's threat model. The Cyber Mission post says Anthropic expects a true positive rate above 90 percent.

The Cyber Verification Program and where Glasswing went

On 6 October 2026 Anthropic expanded its Cyber Verification Program, which lets vetted security teams use its models with fewer of the safeguards that normally block cyber work. It now has three tiers:

• Defense Access for defensive work such as incident response, malware reverse engineering and validating vulnerabilities. Anthropic explicitly lists open source maintainers and individual researchers with a disclosure track record as examples of who should qualify.
• Red Team Access, which adds authorized penetration testing for organizations, not individuals.
• Specialized Access, with the fewest blocks, for a small set of verified organizations that test systems such as power grids, telecom networks and payment infrastructure. Anthropic says existing Glasswing members move to this tier without reapplying for current models.

Anthropic says each tier includes access to its most capable models, including Claude Mythos 5.1, and that data retention is required for enrolled organizations so Anthropic can monitor for misuse. Two days later, the Cyber Mission announcement described Glasswing as merged into this expanded program.

How Anthropic says it discloses what it finds

Because Anthropic scans open source code itself, its disclosure rules matter to every maintainer. Anthropic's coordinated vulnerability disclosure principles, last updated on 6 March 2026, say:

• 90 days by default. Anthropic aims to share details publicly after 90 days or after a patch ships, whichever is first.
• Extensions. A maintainer making progress near the deadline can ask for 14 more days.
• Actively exploited critical bugs get a 7 day target for a patch or mitigation, with a possible further 7 days if the maintainer is working on a fix.
• No response. After 30 days of silence, Anthropic aims to escalate to an external coordinator and publish on schedule.
• Patch details. After a patch, Anthropic generally waits 45 days before publishing full technical details, so users have time to update.
• Report quality. Reports generally reflect findings a human security researcher has reviewed and confirmed. Reports from AI discovery are labeled as such. Candidate patches are included where possible, labeled by provenance.
• Pacing. Anthropic says it will not dump large volumes of findings on a single project without first agreeing a pace the maintainer can sustain.

The Frontier Red Team's April post adds a mechanism for accountability: for bugs it could not yet describe, it published SHA-3 hashes of the details, to be revealed once disclosure completes, no later than 90 plus 45 days after the report.

If you maintain a project and have not thought about disclosure since you added a SECURITY.md years ago, our guides to responsible disclosure in open source and running a vulnerability disclosure program are a reasonable place to start.

What the numbers say so far, and how to read them

Anthropic has published several sets of numbers. All of them come from Anthropic, many from partner surveys, and none has been independently audited. Read them as Anthropic's reported figures.

From the 22 May initial update: about 50 partners had found more than 10,000 high or critical vulnerabilities in their own software in roughly a month. Anthropic had scanned more than 1,000 open source projects; of 1,752 high or critical findings checked by six independent security firms, 90.6 percent were valid and 62.4 percent were confirmed as high or critical. Of an estimated 530 high or critical bugs disclosed to maintainers, 75 were patched and 65 had advisories, and a high or critical bug took two weeks to patch on average.

From the 6 October Cyber Verification Program post: partners reported at least 129,000 verified vulnerabilities between April and July 2026, based on partial data from 33 partner reports, and Anthropic's own open source scanning found 5,500 more between April and October. More than 33,000 were rated critical or high. Fewer than half of partners shared patch counts.

Two cautions. "Verified" means confirmed as real, not fixed or deployed. And the sources do not fully agree on speed. The May update gives a two week average to patch a high or critical bug, while the October Cyber Mission post says Anthropic often saw months pass between a vulnerability being found and fixed during Glasswing. Both can be true, since they measure different spans, so quote neither as typical.

Concrete examples Anthropic has published

From Anthropic's April posts, all since patched: a 27 year old bug in OpenBSD that let a remote attacker crash a machine by connecting to it; a 16 year old bug in FFmpeg in code that automated testing had exercised millions of times; a chain of Linux kernel bugs that escalated an ordinary user to full control; and a 17 year old remote code execution bug in FreeBSD's NFS server, tracked as CVE-2026-4747. In May it described a certificate forgery bug in the wolfSSL library, tracked as CVE-2026-5194. In October, maintainers of PostgreSQL, OpenSSL, wolfSSL, HotCRP and curl described the scanner reports they received as useful.

What Glasswing means for open source maintainers

The headline effect is not "AI finds bugs for you". It is that plausible, often correct security reports now arrive much faster than the human work of verifying, fixing and releasing can absorb. Anthropic says so directly: in May it wrote that progress used to be limited by how fast people could find bugs and is now limited by how fast they can verify, disclose and patch. Several maintainers asked Anthropic to slow its disclosures.

Practical consequences for a maintainer

1. AI discovered reports may arrive whether or not you sign up. Anthropic and others scan widely used code. Make sure your security contact reaches a person.
2. Reports increasingly come with patches. Anthropic's policy includes candidate patches where it can, and OSS Scanner reports include them when available. Treat them as drafts: review, test and own the final fix.
3. You can set the pace. Anthropic's policy says it will agree a sustainable pace before sending many findings to one project. Ask for one.
4. A threat model file pays off. OSS Scanner reads an optional threat model that tells the agents which inputs are hostile, what is out of scope, how to rate severity and what kind of patch you want. Writing it once saves hours of rejecting reports that misread your project.
5. Funding exists for triage. The Linux Foundation's March grants and Anthropic's later Alpha-Omega partnership are aimed specifically at helping maintainers process AI generated reports. Our explainer on the OpenSSF Alpha-Omega project covers how it works.
6. Burnout is a security risk. A flood of good reports is still a flood; see the open source maintainer burnout crisis.

Should you enroll in OSS Scanner?

Anthropic's FAQ is direct: enroll if you already keep up with verified high and critical reports; do not if you are behind. Human reviewed disclosures continue either way.

What Glasswing means for everyone downstream

If you build on open source, Glasswing changes your work in three ways.

More patches, in bigger batches. Anthropic's May update noted partners shipping noticeably larger security releases, and at least one major platform vendor expecting its patch counts to keep rising.

Less time from fix to exploit. Anthropic's Frontier Red Team wrote in April that its model produced working exploits for known bugs from just a CVE identifier and a commit hash, work that used to take a skilled researcher days or weeks. Its advice: tighten patch windows, turn on automatic updates where possible, and treat dependency bumps that carry CVE fixes as urgent. Anthropic also expects other AI companies to have similar capabilities within six to twelve months of June 2026.

The basics count for more. The May update pointed to controls that do not depend on any single patch: hardened defaults, multi factor authentication and good logging, as set out by NIST and the UK National Cyber Security Centre.

For a downstream team that means:

1. Know what you ship. Keep an SBOM per release so you can answer "are we affected?" in minutes. See our guide to SBOM driven incident response.
2. Shrink the gap between an upstream fix and your production build. Automate tested upgrades and measure the delay; our patch management strategies for open source dependencies covers the tradeoffs.
3. Prioritize by reachability and known exploitation, not CVSS alone, when 30 advisories land in one week.
4. Publish exploitability statements for your customers when a component is present but not exploitable. See our VEX guide.
5. Plan for slow or absent upstreams. Some maintainers will be overwhelmed and some projects are unmaintained; the remediation section below covers that case.

Limits and open questions

Glasswing is a serious effort, and it is also a program run by one company. These questions remain open.

Access is gated, and the gate is Anthropic's. Anthropic picks partners and sets security requirements, and says it reviews Specialized Access organizations in collaboration with the US government. Maintainers outside those criteria get the open source routes, not partner access.

"Free for maintainers" needs careful reading. The Linux Foundation describes free maintainer access as a design goal. Anthropic's free routes are reports, a scanner, foundation programs and a general subscription. We found no Anthropic page promising every maintainer direct Mythos access.

Unreviewed reports shift work. OSS Scanner is explicit about false positives and inflated severity. That is honest, but it moves verification cost onto maintainers who opt in.

The numbers are self reported. Partner totals come from partial surveys, and Anthropic says impact and patch rates are both undercounted. Neither can be checked from outside yet; the SHA-3 commitments help for specific claims, not aggregates.

Disclosure lags discovery by design, so downstream defenders will see a fraction of what has been found for months.

Concentration. Anthropic itself suggests an independent third party body might eventually be the right home for this work. Until then, much of the coordination runs through one vendor's process.

Data retention and cost. Cyber Verification Program members must allow data retention for misuse monitoring, so read the terms before pasting embargoed details. Anthropic listed per token pricing for participants after the research preview; how that applies to non profit maintainers under the October tiers is not spelled out on the pages we reviewed.

Step by step: get ready, whether you maintain or consume

The steps below use public, documented tools. None of them requires access to Glasswing.

For maintainers

1. Publish a working security contact. Put a SECURITY.md in the repository root with a monitored address and your supported versions. OSS Scanner checks that the reporting contact matches what the project publishes, for example in SECURITY.md.

# Security policy

## Reporting a vulnerability
Email security@example.org or use GitHub private vulnerability reporting.
We acknowledge reports within 5 working days.

## Supported versions
3.x receives security fixes. Older versions do not.

## AI generated reports
We accept AI assisted reports that include a reproducer.
Please tell us if a report was generated by a model.

2. Turn on private vulnerability reporting. GitHub documents a repository setting that gives researchers a private form instead of a public issue. You can enable it in Settings, or from the command line with the GitHub CLI if you have admin rights on the repository:

# Enable private vulnerability reporting (admin rights needed)
gh api -X PUT repos/OWNER/REPO/private-vulnerability-reporting

# Confirm it is on
gh api repos/OWNER/REPO/private-vulnerability-reporting

3. Check your project's security posture. OpenSSF Scorecard runs automated checks on things like branch protection, pinned dependencies and token permissions. It needs a GitHub token.

export GITHUB_AUTH_TOKEN=<your token>
docker run -e GITHUB_AUTH_TOKEN ghcr.io/ossf/scorecard:latest \
  --show-details --repo=https://github.com/OWNER/REPO

4. Know your criticality score. Claude for Open Source accepts maintainers of any repository with an OpenSSF criticality score of 0.4 or above, and OSS Scanner considers it too. The OpenSSF tool computes it; its README notes that its hosted Google Cloud data is no longer available after 29 August 2026 and points to a data directory in the repository instead.

go install github.com/ossf/criticality_score/v2/cmd/criticality_score@latest
export GITHUB_TOKEN=<your token>
# -depsdev-disable skips the optional dependents lookup that needs a cloud project
criticality_score -depsdev-disable https://github.com/OWNER/REPO

5. If you decide to enroll in OSS Scanner, prepare the three files. The project template in Anthropic's repository asks for a project.yaml, a Dockerfile that builds your project and its tests with all dependencies installed, and optionally a threat model. A minimal project.yaml based on the published template looks like this:

# projects/yourproject/project.yaml in the anthropics/oss-scanner repository
repo: https://github.com/OWNER/REPO#main
primary_contact: security@example.org
auto_ccs:
  - second-maintainer@example.org
homepage: https://example.org
dockerfile: .oss-scanner/Dockerfile
threat_model: .oss-scanner/threat_model.md
disabled: false

Build the Dockerfile locally and run your tests inside it with the network off, since the scan runs offline:

docker build -f .oss-scanner/Dockerfile -t yourproject-scan .
docker run --rm --network none yourproject-scan make test

Add a short threat_model.md that lists which inputs are untrusted, what is out of scope, your severity rubric and whether you want minimal or merge ready patches. The scanner works without it, but guesses at the corner cases.

6. Set up a triage lane. Label AI discovered reports so you can measure how many were valid and how long fixes took. If you patch something OSS Scanner found, Anthropic asks, but does not require, that you put the report ID in the commit message.

For teams that consume open source

1. Generate an SBOM and scan it. Any SBOM tool works for the inventory. With the Safeguard CLI, scanning a repository, an image or an existing SBOM looks like this, with JSON results written under ./output:

# Scan the current repository's dependencies
safeguard scan --dir .

# Scan a container image you ship
safeguard scan --image registry.example.com/app:1.4.2

# Scan an SBOM a supplier gave you
safeguard scan --sbom vendor-sbom.cdx.json

2. Check where a package from a fresh advisory lives. When a batch of advisories lands, start with the package managers you already have:

npm ls ws                 # Node: which paths pull in a package
pip show cryptography     # Python: installed version
go list -m all | grep golang.org/x/net
mvn dependency:tree -Dincludes=org.apache.commons:commons-text

3. Gate builds on known exploited vulnerabilities. The free Gold scan GitHub Action described in the remediation section below can fail a build on a known exploited vulnerability, so a version you just removed does not drift back in.

Where Safeguard fits

Safeguard does not run Glasswing, does not provide access to Anthropic's restricted models and does not decide what Anthropic discloses. Our place is downstream, where the patches maintainers ship have to reach your builds.

What Safeguard does there, with its generally available features: scan repositories, container images and SBOM files for dependencies and match them against vulnerability databases; show which projects contain a given component and version; rank findings with reachability analysis so you fix the code paths you actually call first; evaluate policies and gates; and open tested fix pull requests through autonomous remediation, which ships switched off so your team decides what runs on its own.

Where Safeguard does not help: it is not a substitute for upstream maintainers finding and fixing bugs in their own code, it cannot make an overwhelmed maintainer ship faster, and it does not patch an operating system or vendor appliance you do not build yourself.

Common mistakes

• Assuming Glasswing gave every maintainer a Mythos account. It did not. The open source routes are reports, a scanner, foundation programs and a general subscription. Check what you actually qualify for.
• Enrolling in OSS Scanner while already behind. Anthropic's own FAQ says the service is for projects that keep up with verified reports. Raw findings on top of a backlog make things worse.
• Merging AI candidate patches without review. Review it, add a regression test and check it against your threat model.
• Leaving SECURITY.md stale. Under Anthropic's policy, 30 days of silence means escalation to an external coordinator.
• Treating big upstream security releases as routine. Anthropic's advice is to treat CVE carrying dependency bumps as urgent. A two week batching habit is now a two week exposure window with faster exploit writing on the other side.

FAQ

What is Project Glasswing in simple terms?

An Anthropic program that gives a restricted AI model to organizations maintaining important software so they can find and fix security bugs first. Anthropic also scans open source projects itself, reports findings to maintainers and funds open source security foundations.

Who is part of Project Glasswing?

Twelve launch organizations including Anthropic and the Linux Foundation, plus more than 40 critical software organizations at launch and about 150 more in June 2026, across more than 15 countries.

Can open source maintainers get access to Claude Mythos?

Not automatically. Anthropic points maintainers to Claude for Open Source, which offers six months of Claude Max 20x, and to the Cyber Verification Program, whose tiers include Claude Mythos 5.1 for approved applicants. Whether a given maintainer receives Mythos access is decided per application. OSS Scanner reports are generated by Anthropic's models including Mythos, but you receive reports, not model access.

How much money is involved?

Anthropic committed up to $100M in model usage credits and $4M in direct donations at launch: $2.5M to Alpha-Omega and OpenSSF through the Linux Foundation and $1.5M to the Apache Software Foundation. Separately, in March 2026 the Linux Foundation announced $12.5M in grants from seven organizations including Anthropic.

Will Anthropic publish vulnerabilities in my project?

Under its disclosure principles, Anthropic aims to publish details 90 days after reporting or after a patch ships, whichever comes first, with extensions possible. After a patch, it generally waits 45 days before full technical details. Actively exploited critical bugs have a 7 day target. Unvalidated OSS Scanner findings carry no disclosure clock.

Are AI generated vulnerability reports reliable now?

Better than they were, but not perfect. In Anthropic's checks about 9 in 10 reviewed high or critical findings were valid, yet maintainers still see inflated severity. Verify every report and patch.

Is Project Glasswing still running?

In a changed form. On 6 October 2026 Anthropic said existing members move to the Specialized Access tier of its Cyber Verification Program, and on 8 October it described Glasswing as merged into that program. The open source work continues through OSS Scanner, human reviewed disclosures and the Anthropic Cyber Mission.

What should a company that only uses open source do about Glasswing?

Expect more security releases and faster exploits. Keep an SBOM per release, automate tested upgrades, prioritize by reachability and known exploitation, and plan for slow upstreams.

Fix it without waiting for upstream

Glasswing's own updates say the slow step is no longer finding bugs but getting patches written, released and deployed, and some upstream projects simply will not keep up. That gap between a fix existing upstream, or not existing at all, and the fix running in your builds is exactly what the controls below address.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

None of these demos involve Glasswing or Anthropic's restricted models. They show the downstream half of the story: taking a fix that exists upstream and getting it into your code with a person approving each step. If you want to try it, download the CLI from https://safeguard.sh/download and read the setup guide at https://docs.safeguard.sh/docs/cli . For background on the assistant itself, see the Safeguard CLI overview.

The first demo is a real CLI session. After install, safeguard opens the interactive terminal, you ask it to fix the lodash CVE in a repo, and it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. When a Glasswing era batch of upstream fixes lands, this is the same loop applied to each affected dependency, with your tests as the check.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code, then scans from the terminal. Running scans locally suits teams that want to check every repository against a new batch of advisories without sending source code anywhere new.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. If your team already uses Claude for security work, this is how you give it your inventory and findings while keeping the tool list narrow.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Linux Foundation: Introducing Project Glasswing: Giving Maintainers Advanced AI to Secure the World's Code (7 April 2026)
• Anthropic: Project Glasswing
• Anthropic Frontier Red Team: Claude Mythos Preview's cybersecurity capabilities (7 April 2026)
• Anthropic: Coordinated vulnerability disclosure for Claude discovered vulnerabilities
• Anthropic: Project Glasswing, an initial update (22 May 2026)
• Anthropic: Expanding Project Glasswing (2 June 2026)
• Anthropic: Introducing Claude Fable 5.1 and Claude Mythos 5.1
• Anthropic: Expanding the Cyber Verification Program (6 October 2026)
• Anthropic: Introducing the Anthropic Cyber Mission (8 October 2026)
• Anthropic: Launching an opt in vulnerability finding service for open source software (8 October 2026)
• Anthropic: OSS Scanner overview and FAQ
• Anthropic: OSS Scanner project template on GitHub
• Claude: Claude for Open Source
• OpenSSF: Linux Foundation Announces $12.5 Million in Grant Funding to Advance Open Source Security (17 March 2026)
• Alpha-Omega
• GitHub Docs: Configuring private vulnerability reporting for a repository
• OpenSSF Scorecard README
• OpenSSF Criticality Score README

Last reviewed: 23 October 2026. Anthropic has changed Glasswing's structure several times since April 2026; check the linked Anthropic and Linux Foundation pages for the current access routes and numbers.