AI-Powered Vulnerability Discovery Centralized Among Tech Giants
Anthropic's Project Glasswing distributes a powerful AI vulnerability-finding model, Claude Mythos Preview, exclusively to major tech firms and about 40 critical infrastructure organizations. This model has uncovered thousands of previously unknown security flaws, including decades-old bugs in OpenBSD and FFmpeg, challenging the assumption that mature, security-focused projects are exhaustively reviewed. The centralization of this capability means that discovery, disclosure, and remediation processes are now controlled by a small group of large vendors and partners. Smaller open-source maintainers may become dependent on these organizations for vulnerability reports and patch timelines, potentially affecting the speed and transparency of fixes. This shift is strategic rather than an immediate emergency, but it signals a new dynamic in software security where powerful AI tools are not broadly accessible but concentrated within a select consortium.