Interesting Announcement - "Project Glasswing"

Today we’re announcing Project Glasswing1, a new initiative that brings together Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks in an effort to secure the world’s most critical software.

We formed Project Glasswing because of capabilities we’ve observed in a new frontier model trained by Anthropic that we believe could reshape cybersecurity. […]

Mythos Preview has already found thousands of high-severity vulnerabilities, including some in every major operating system and web browser. […] Project Glasswing is an urgent attempt to put these capabilities to work for defensive purposes.

[…] Anthropic is committing up to $100M in usage credits for Mythos Preview across these efforts, as well as $4M in direct donations to open-source security organizations.

Project Glasswing is a starting point. No one organization can solve these cybersecurity problems alone: frontier AI developers, other software companies, security researchers, open-source maintainers, and governments across the world all have essential roles to play. […]

Prompt to Claude:

Can Meteor.js become a participant in Project Glasswing?

Response from Claude:

This is a very fresh announcement — Project Glasswing was just revealed today! Here’s what
we know about participation and whether Meteor.js could qualify.

What is Project Glasswing?

Anthropic’s Project Glasswing aims to “secure the world’s most critical software” against
AI-powered attacks. It includes major launch partners such as Amazon Web Services, Apple,
Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft,
NVIDIA, and Palo Alto Networks. The centerpiece is Claude Mythos Preview, an unreleased AI
model that Anthropic is making available exclusively to project partners and approximately
40 additional organizations responsible for critical software infrastructure.

Can Meteor.js participate?

Possibly — there are two relevant pathways:

1. The “40+ additional organizations” tier

Anthropic has extended access to a group of over 40 additional organizations that build or
maintain critical software infrastructure so they can use the model to scan and secure both
first-party and open-source systems. Meteor.js, as a widely used open-source JavaScript
framework, could potentially qualify here, though selection criteria haven’t been made fully
public.

2. Claude for Open Source program

Maintainers interested in access can apply through the Claude for Open Source program. This
is the most accessible and clearly defined pathway for an open-source project like Meteor.js.
Anthropic has donated $4M to open-source security organizations specifically to support
maintainers.

Relevant context: The initiative is designed to ensure that maintainers get access to
these tools for free, with the goal of fostering wide adoption of top AI cybersecurity
capabilities by removing economic friction.

Bottom line

Meteor.js would most plausibly qualify through the Claude for Open Source program, given
that it’s an open-source project. Whether it rises to the level of “critical software
infrastructure” that Anthropic is targeting (think OS kernels, web browsers, etc.) is the
key question — Meteor.js is widely used but may face competition for limited slots from
higher-profile infrastructure projects. The Meteor.js maintainers could apply and make the
case for their project’s criticality. Check out anthropic.com/glasswing and the Claude
for Open Source program directly for application details.

YouTube video nSdY5QA1MRI has some details about what this is.

2 Likes
2 Likes
2 Likes
1 Like

[…] in that article, “harness” is basically shorthand for a whole orchestration system wrapped around the LLM. It’s much more than “ask Claude to review code.”

Mozilla hints at the pieces, but if you unpack what security researchers usually mean by an “agentic harness,” it probably includes something like this: […]

Anthropic is known for catastrophic marketing to get people to buy their stuff. From what I have heard Mythos is partially so good because of the amount of compute and brute forcing that it does. In that respect it is expensive for the general use. Project Glasswing is nice, but it creates a two tier structure that can make bad situations with AI even worse.
At the same time I would say that all of this is increasingly endangering the existence of FOSS.

At the same time I would say that all of this is increasingly endangering the existence of FOSS.

I would say instead that this is making FOSS stronger.

Many FOSS projects have received vulnerability reports from Project Glasswing, and those bugs have been fixed.

For CURL, because project was in so good shape, Mythos found only one vulnerability.

Maybe, but take the Linux Kernel for example. How long is it going to take for everyone to upgrade and in the meantime leave them vulnerable.

@fredmaiaarantes @italojs @nachocodoner I think we need a dedicated release where we use something like Daybreak and take a major look at the accounts packages. I’m almost finished with one thing that will free some time for me and allow me to take a look at it. But, depending on the results we might want to have a private branch or something to hide these changes before publication so that they don’t get exploited before we have a fix out there.

https://openai.com/daybreak/

3 Likes

Nothing only acconuts but the hole framework imo.

Actually, we have something like that, and we already addressed many security fixes that you didn’t know XD


btw, just attaching our security page in this thread

1 Like