Anthropic allows Project Glasswing partners to share findings from the Mythos cybersecurity model with parties outside the program. This applies to security teams, regulators, open-source maintainers, and the media. The relaxation follows initial confidentiality agreements that the partners themselves had requested.
Partners are now permitted to share findings, best practices, tools, and code. Last week, Anthropic informed partners that they may publicly disclose their participation in Glasswing. “We fully support our partners in sharing findings with each other and with companies outside of Glasswing to prioritize vulnerabilities,” said a spokesperson for Anthropic.
Confidentiality protections at the request of partners
Confidentiality was not imposed by Anthropic; it was requested by the partners themselves. Partners had concerns about sharing sensitive findings and did not want to become targets of attackers. “While there was never a specific Glasswing NDA, confidentiality protections were something partners asked for at the outset and were built into agreements partners signed,” the Anthropic spokesperson said. As the program matured, Anthropic adjusted those agreements to allow for broader dissemination.
Partners can now share findings with security teams at other companies, industry organizations, regulators, government agencies, open-source maintainers, the media, and the public, provided it aligns with responsible disclosure standards.
Mythos was announced on April 7 as part of Project Glasswing. The model can code at a high level, potentially giving it an unprecedented ability to identify vulnerabilities.
Earlier in May, the Dutch NCSC warned about Mythos’s capabilities, which can automatically detect vulnerabilities and build complete attack chains. The Pentagon is also using Mythos to detect and patch software vulnerabilities in U.S. government systems, the Department of Defense’s top technology official announced last week.