Recently, the company Anthropic announced that within just one month of launching their Project Glasswing, they have collaborated with approximately 50 partners to successfully identify over 10,000 high and critical security vulnerabilities. This achievement has greatly impressed the entire tech community, demonstrating the significant potential of AI in the field of cybersecurity.

According to feedback from partners, the Claude Mythos Preview model developed by Anthropic has shown remarkable improvement in its ability to detect vulnerabilities. Some teams have even seen a tenfold increase in the speed of vulnerability discovery, meaning tasks that once took days can now be completed in just a few hours. The bottleneck in vulnerability mining has now shifted from "discovering vulnerabilities" to "validating, disclosing, and fixing them," presenting new challenges for security teams.

For example, Cloudflare discovered 2000 vulnerabilities in its critical systems, 400 of which were rated as high or critical. Compared to traditional manual testing, the false positive rate of the Claude model has significantly decreased, showing higher accuracy. Meanwhile, Mozilla fixed 271 vulnerabilities in the latest version of its Firefox browser, a number ten times greater than that of the previous version, highlighting the value of AI in improving the efficiency of repairs.

In independent evaluations, the Mythos Preview model also performed well. The UK AI Safety Institute called it the first model to successfully breach two network defense training grounds, while the XBOW platform also noted that it outperformed existing models in web exploitation, with extremely high accuracy.

Additionally, over the past few months, Anthropic has conducted a large-scale scan of open-source software, identifying 23,019 vulnerabilities, including medium and low-risk ones. After manual verification, 1,587 of these were confirmed as real high or critical vulnerabilities, achieving a true rate of 90.6%. Even without discovering new vulnerabilities, it is estimated that nearly 3,900 high or critical vulnerabilities will still need to be addressed in the end.

However, the process of patching vulnerabilities is not simple. Anthropic pointed out that it takes an average of two weeks to release a patch after discovering a high-risk vulnerability. Some open-source maintainers have even stated that due to the inability to handle the volume of AI-generated vulnerability reports, they need to slow down the disclosure pace. Such situations mean that the workload for security teams will become even heavier in the future.

Key Points:

🔍 Over 10,000 high-risk vulnerabilities were discovered by Anthropic's AI model, with a significant improvement in speed!

⚙️ Traditional vulnerability detection has reduced false positives, and AI has helped improve repair efficiency.

⏳ The process of vulnerability repair is under pressure, and open-source maintainers are requesting to slow down the disclosure pace.