Glasswing Widens: Anthropic Puts Mythos Inside Power, Water and Hospital Operators Across More than 15 Countries

Key Takeaways

• Anthropic adds 150 critical‑infrastructure firms to Glasswing program
• Claude Mythos has identified over 10,000 high‑severity bugs
• AI‑driven discovery shifts bottleneck from detection to patching
• Cyber‑insurance may price coverage based on Mythos access
• New executive order creates 30‑day pre‑release AI security review

Pulse Analysis

The rollout of Anthropic’s Claude Mythos into power grids, water treatment plants, hospitals and telecom networks marks a watershed moment for AI‑augmented cyber‑defense. By automating the discovery of high‑severity software flaws at a scale previously unattainable, Mythos enables operators to pre‑empt attacks that could disrupt services for millions. This capability is especially valuable as critical‑infrastructure operators face increasingly sophisticated threat actors who are also experimenting with generative AI for offense. The rapid identification of vulnerabilities—evidenced by Cloudflare’s 2,000 bugs and Mozilla’s 271 fixes—demonstrates that AI can outpace traditional pen‑testing, reshaping the security talent market and prompting firms to rethink resource allocation.

However, the acceleration of bug discovery introduces a new bottleneck: remediation. Organizations now receive a flood of validated findings, straining patch‑management processes and staffing capacities. Legal and e‑discovery teams must treat AI‑generated vulnerability inventories as discoverable evidence, integrating them into retention schedules and privilege assessments much like SIEM alerts. Vendors offering governance platforms are likely to add support for Mythos‑derived data, while boards will need to evaluate whether their incident‑response playbooks assume access to frontier AI tools. The shift underscores the importance of coordinated patch‑deployment pipelines and cross‑functional collaboration between security, IT and compliance.

From a market perspective, Mythos access is poised to become a differentiator in cyber‑insurance underwriting. Underwriters may begin to weight participation in Glasswing as a risk‑mitigation factor, potentially leading to premium discounts for members and higher costs for non‑participants. The simultaneous introduction of a presidential executive order mandating a 30‑day pre‑release review for covered AI models adds regulatory momentum, encouraging broader industry adoption of vetted frontier models. As competitors like OpenAI prepare their own cyber‑focused LLMs, the coming six‑to‑12 months will likely see a proliferation of powerful AI tools, making early adopters of Anthropic’s controlled program better positioned to navigate both technical and compliance challenges.