Project Glasswing: When AI Becomes the Ultimate Hacker—and Defender

Anthropic's Project Glasswing, powered by the unreleased AI model Claude Mythos, is poised to autonomously discover zero-day vulnerabilities and chain exploits across global software systems—raising alarms about the dual-use potential of AI in cybersecurity. The system, not being released to the public and restricted to select partners like Microsoft, Google, and JP Morgan, is framed as a defensive tool, but panelists Kevin Tackett and Scott Wright argue it's a dangerous distraction. They warn that without fixing the root causes—like underfunded open-source maintenance and legacy systems—AI-driven vulnerability discovery only piles on more problems without real resolution. The real threat isn't just the AI itself, but the industry’s obsession with offensive capabilities over defense, compliance, and code quality. As one guest puts it, 'We’re not fixing shit,' and the wake-up call from Glasswing may just be ignored, leading to more attacks, not better security. The conversation exposes a deeper crisis: the cybersecurity industry’s failure to prioritize code quality, bug remediation, and responsible AI deployment. Despite the hype, many organizations still run outdated systems vulnerable to exploits from 1995. The panel questions whether AI tools like Mythos will drive meaningful change or merely fuel a cycle of discovery without action.