AI Just Found 129,000 Security Holes. Who Gets the Keys?

Did you know AI just helped find more than 129,000 software security holes in four months?

That’s right! On October 6, Anthropic expanded its Cyber Verification Program, or CVP. At the same time, it folded in Project Glasswing, its defensive security initiative. According to Anthropic, Glasswing partners found at least 129,000 verified vulnerabilities between April and July. Moreover, partners rated more than 33,000 of them as critical or high severity. On top of that, Anthropic’s own open-source scanning found about 5,500 more.

However, those numbers come with fine print. Anthropic and its partners reported them, so nobody has measured them independently. According to SiliconANGLE, the figures come from partner surveys. In fact, fewer than half of the partners shared how many patches they shipped. Anthropic still believes the true number is higher, possibly five times higher.

What is Project Glasswing?

Glasswing launched on April 7 together with Claude Mythos Preview. Anthropic said it would not release that model to the general public. Instead, it shared the model with a small group of partners. These included AWS, Apple, Cisco, CrowdStrike, Google, JPMorganChase, Microsoft, Nvidia and Palo Alto Networks. More than 40 other groups also got access.

In addition, Anthropic committed up to $100 million in usage credits. It also pledged $4 million to open-source security groups. Then, in June, it opened the program to around 150 more organizations.

Project Glasswing is an urgent attempt to put these capabilities to work for defensive purposes.

Anthropic, at the April launch

You see, AI cuts both ways

Powerful models are getting very good at reading code. As a result, they spot bugs that humans missed for years. That is great news for defenders. But the same skill can also help attackers, and that is already happening.

For example, Anthropic’s September threat report describes a group linked to ShinyHunters affiliates. This group hit about 40 corporate tenants in roughly 34 hours. Meanwhile, AI agents did nearly all of the work. The report’s conclusion is blunt: “AI has inverted the cost back onto defenders.” That is why we keep asking who controls AI agents’ actions.

Three tiers of access

Diagram: the three tiers of Anthropic’s Cyber Verification Program, by CVisiona (https://cvisiona.com)

Every tier includes Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1. However, these versions come with fewer cyber safeguards than ordinary users see. In return, members must allow data retention, so Anthropic can watch for misuse. Access runs through the Claude Platform, Google Cloud Vertex AI and Microsoft Foundry. Later this fall, customers should also be able to keep their data on their own infrastructure.

So who can apply? Defense Access is the broadest tier. It covers security teams, infrastructure operators, open-source maintainers and proven researchers. Healthcare IT News, for instance, mentions regional hospitals and municipal utilities. Anthropic aims to respond to these requests within a few days.

Red Team Access, on the other hand, takes a few weeks of review. Meanwhile, applicants can use Defense Access. Existing Glasswing members, by contrast, move straight into Specialized Access.

But here’s the twist

This is not a cosmetic change. Anthropic tested Claude Opus 5.5 on 50 attack scenarios. With a normal account, its safeguards stopped every task at the first prompt. With Defense Access, they still stopped 46 of 50 runs. With Red Team Access, however, the safeguards stopped nothing. The model completed 34 of 50 tasks, the same as with no safeguards at all.

In other words, Anthropic now decides who gets the unlocked version of its best models. So the real product here is access policy, not just model quality.

The skeptic’s view

Still, not every bug is a breach waiting to happen. According to The Hacker News, VulnCheck researcher Patrick Garrity studied 300 vulnerabilities credited to Anthropic or Glasswing. He found that attackers had exploited only two of them. Veracode and 1Password also warn that AI-written patches can add new flaws.

Finding bugs is the easy part. Fixing them, on the other hand, is where the pain lives. For example, Healthcare IT News reports that Epic paused new product work for a few weeks to patch its flaws. Its security chief, Stirling Martin, told hospitals to “patch, patch, patch.” Anthropic has also joined an OpenAI-led call to action. It warns that hospitals and water plants have a “limited window” to strengthen their defenses.

What it means for builders

For security teams, the lesson is simple. Finding bugs is about to get much cheaper, so patching speed becomes the bottleneck. For the industry, the bigger shift is governance. Just like in the open-weight AI debate, capability is no longer the only question. Instead, the question is who we trust with it. And as Anthropic grows its compute, these choices will matter even more. We covered that side of the story in Anthropic’s custom chip strategy.

So what should you do now? First, check whether your team qualifies for Defense Access. Next, measure how fast you ship patches today. Finally, test AI-written fixes as carefully as human ones, because a rushed patch can open a new hole.

AI is becoming extraordinarily good at finding weaknesses in software. The next challenge is making sure the defenders find them first.

Sources & Credits

• Text credit & news reporting source: Anthropic, “Expanding our Cyber Verification Program” (October 6, 2026)
• News reporting source: The Hacker News (October 7, 2026)
• News reporting source: SiliconANGLE (October 6, 2026)
• News reporting source: Healthcare IT News (October 8, 2026)
• Background: Constellation Research, Project Glasswing launch (April 7, 2026)
• Background: Anthropic threat intelligence report (September 2026)
• Image: Anthropic. Diagram: CVisiona

Should AI labs decide who gets their most powerful security tools? Tell us in the comments.