---
title: "Project Glasswing and the AI Vulnerability Math Problem"
description: "See analysis of one of the overlooked impacts of recent developments in AI vulnerability discovery and exploitation."
canonical_url: "https://fossa.com/blog/project-glasswing-ai-vulnerability-math-problem/"
markdown_url: "https://fossa.com/blog/project-glasswing-ai-vulnerability-math-problem.md"
content_type: "blog"
language: "en"
date_published: "2026-04-23"
date_modified: "2026-04-23"
author: "Carlos Cheung"
organization: "FOSSA"
---

# Project Glasswing and the AI Vulnerability Math Problem

> See analysis of one of the overlooked impacts of recent developments in AI vulnerability discovery and exploitation.

*fossabot. The bot that gives you wings, glasswings*

In case you missed it: Anthropic announced [Project Glasswing](https://www.anthropic.com/glasswing), a coalition of companies committed to defending against emerging threats from AI-enabled vulnerability exploitation.

Project Glasswing is a great first step to help the ecosystem prepare for the reality that AI will enable attackers to exploit more vulnerabilities, more quickly. But it’s only part of the solution.

> **[RELATED: Project Glasswing and the Outdated Dependencies Problem](https://fossa.com/blog/project-glasswing-vulnerability-exploitation-velocity.md)**

It’s true that, in theory, if we can find security flaws at hyper speed and fix them at ludicrous speed, then we should be able to get close to a meaningfully improved security posture. However, there’s a major concern with this hypothesis: What happens between the time when a new version is deployed that contains the fix and when you make the upgrade for your application?

      Step 1

        <svg viewBox="0 0 24 24" className="h-4 w-4 md:h-5 md:w-5" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" aria-hidden="true">
          <circle cx="11" cy="11" r="7" />
          <line x1="16.65" y1="16.65" x2="21" y2="21" />
        </svg>

      <p className="mt-3 text-xl font-semibold leading-none text-white md:text-2xl">Find</p>

    ->

      Step 2

        <svg viewBox="0 0 24 24" className="h-4 w-4 md:h-5 md:w-5" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" aria-hidden="true">
          <path d="M14.7 6.3a4 4 0 0 0-5.4 5.9L3 18.5V21h2.5l6.3-6.3a4 4 0 0 0 5.9-5.4L14 13l-3-3 3.7-3.7z" />
        </svg>

      <p className="mt-3 text-xl font-semibold leading-none text-white md:text-2xl">Fix</p>

    ->

      Step 3

        <svg viewBox="0 0 24 24" className="h-4 w-4 md:h-5 md:w-5" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" aria-hidden="true">
          <rect x="3" y="3" width="18" height="18" rx="3" />
          <path d="M8 12.5l2.5 2.5L16 9.5" />
        </svg>

      <p className="mt-3 text-xl font-semibold leading-none text-white md:text-2xl">Safe?</p>

Let’s take a look at the math.

## Step 1: Find (Mythos or Another New LLM)

One of the insights in Anthropic’s Project Glasswing announcement was that Claude Mythos (an unreleased frontier model) discovered several previously unknown vulnerabilities in popular OSS projects. These included ones in OpenBSD (27-year-old flaw), FFmpeg (16-year-old flaw), and the Linux Kernel.

This disclosure speaks to the likelihood that AI models will help us find a materially larger number of vulnerabilities than traditional tools and scanners.

* **Simple Math.** Traditional security researchers discover “y” number of vulnerabilities on an annualized basis

* **AI Math.** AI-enabled vulnerability research with traditional security researchers discover “y” multiplied by a factor of 100x number of vulnerabilities

## Step 2: Fix (Project Glasswing)

One of the expected outcomes of Project Glasswing (and similar advances in AI security) is a significant increase in velocity of fixes being deployed.

Attackers will be able to exploit vulnerabilities more quickly, but AI will be able to accelerate the process of discovering and patching.

* **Simple Math.** 3 components with vulnerabilities each can be fixed with individually new safe versions.
* **AI Math.** 1,000-plus components with AI-assisted fixes.

## Step 3: Safe? Nope.

The vulnerability is found, and a fix is deployed. This has been the workflow for ages,  even pre-advanced models like Mythos.

However, just because the problem is found and the fix is available doesn’t mean people act on it. This is because we end up finding thousands of vulnerabilities, and we try to rationalize that we might not be impacted by them (reachability, run-time checks, etc.). However, if there is a critical CVE that is not accessible today, that does not mean it won't be accessible tomorrow. Let that sit for a second.

Once a security vulnerability gets issued across the ecosystem with a fix, then teams still have to take an action somehow:

* Change to a safe version (\*note this could be from a service provider with a patched version, a newer community version, or an internally patched version)
* Migrate to a comparable package (\*note some would rewrite their own)
* Remove the function entirely.  (\*note this is probably the worst outcome)

## Getting to Safe with AI Math

So how do we really get to **safe** with AI Math?

The answer is Step 2.5: [fossabot](https://fossa.com/products/fossabot.md) (our AI-enabled auto-dependency updater) plus Mythos/Glasswings. The combination enables safe upgrades at scale — mass dependency upgrades with code compatibility.

As software engineers, we all know that upgrading a dependency has never been super simple. Ask any engineer how much time it’ll take, and you generally get an “it depends…” response. It depends on how we’re using it, it depends on what changed, and it depends on how much time/AI we can spend on it.

* **AI Math**
  * **Mythos** finds. 1000s+.
  * **Glasswing** fixes. 1000s+.
  * **fossabot** upgrades. 1000s+
  * \= Safe-ish.

Our vision is available now, and we encourage you to try fossabot for yourself. We’re offering credits for your first 100 upgrades/remediations for the next four weeks — you can [request a demo on our site](https://fossa.com/request-demo) or email us ([hello@fossa.com](mailto:hello@fossa.com)) with questions or to get started.

We’re excited about finding all these vulnerabilities, seeing fixes available for all these vulnerabilities, and most importantly, helping you manage your software engineering process in using open source.

**About the Author**

Carlos Cheung is a member of FOSSA’s founding team.

## Related resources

- [The Underappreciated OSS License Compliance Risk from AI Coding Tools](https://fossa.com/blog/underappreciated-oss-license-risk-ai-coding-tools.md): Learn about an under-the-radar IP risk from the use of AI coding assistants.
- [Project Glasswing and Vulnerability Exploitation Velocity](https://fossa.com/blog/project-glasswing-vulnerability-exploitation-velocity.md): FOSSA CEO Aaron Williams shares his insights on Project Glasswing the new AI-enabled vulnerability exploitation landscape.
- [Heather Meeker on AI Coding Assistants and OSS License Compliance](https://fossa.com/blog/heather-meeker-ai-coding-assistants-oss-license-compliance.md): Leading IP attorney and OSS license compliance expert Heather Meeker discuss the license compliance implications of using AI coding assistants.
- [Manage AI Coding Tool Risks with FOSSA Snippet Scanning](https://fossa.com/blog/ai-coding-tool-risks-fossa-snippet-scanning.md): FOSSA's new Snippet Scanning product helps organizations manage IP legal risks associated with AI coding tools.
- [A VP of Engineering’s Perspective on FOSSA’s AI Journey](https://fossa.com/blog/a-vp-engineering-perspective-fossa-ai-journey.md): FOSSA's VP of Engineering Dave Bortz shares insight into the FOSSA engineering team's AI coding philosophy.

## Source

Canonical page: https://fossa.com/blog/project-glasswing-ai-vulnerability-math-problem/