Project Glasswing (Organization): news timeline & CVEs

Anthropic-linked CVEs pile up, attackers mostly shrug

VulnCheck finds only one of 225 Anthropic Glasswing-linked CVEs, Ghost SQL injection CVE-2026-26980, exploited in the wild.

VulnCheck researcher Patrick Garrity tracked 225 CVEs credited to Anthropic or Project Glasswing, whose partners use restricted Claude Mythos Preview for defensive bug hunting. Only CVE-2026-26980, a critical SQL injection in Ghost, is on VulnCheck's known-exploited index. Garrity said these disclosures are not producing different threat outcomes than a typical sample, where roughly 1–2% of flaws are weaponized. Separate studies found ChatGPT-5.5 and Claude Opus 4.8 fully resolved vulnerabilities 26% of the time, and Veracode reported a 56% average security pass rate for AI-generated code.

The Register · SecuritySep 21, 22:32 UTC · 5d agoResearch in the wildCVE-2026-26980

Unit 42 warns AI has shifted balance of power from defenders to attackers

Unit 42 says agentic AI has shifted attacker advantage, investigating an incident where one attacker exploited 50 enterprise applications in under 10 hours.

Palo Alto Networks Unit 42 leaders said early waves of agentic AI-enabled attacks are breaking in the wild and that frontier model capabilities have shifted the balance of power from defenders to attackers. The team is actively investigating an attack on a customer where an attacker used an agentic framework to exploit 50 applications and other weaknesses across the enterprise in less than 10 hours, work they estimate would have taken at least 10 days pre-AI. Unit 42 says AI already touches the entire attack chain, including malware development, social engineering, and ransomware negotiations. The warning follows April's Project Glasswing initiative formed with Anthropic around its Mythos model.

CyberScoopAug 27, 18:31 UTC · Aug 27, 2026AI safety & security in the wild1

Project Glasswing

Timeline2 articles

Related CVEsby mentions

Appears with

Anthropic-linked CVEs pile up, attackers mostly shrug

Unit 42 warns AI has shifted balance of power from defenders to attackers