Assessment of “Claude Mythos” and Project Glasswing

The speed at which artificial intelligence is transforming cybersecurity has reached a new level. We would like to inform you about significant developments, share our assessments – including specific recommendations – and highlight how we respond to this new threat level in collaboration with our partners.

Technological turning point: Claude Mythos

On April 7, 2026, Anthropic presented the preview of “Claude Mythos.” This latest-generation AI model marks a turning point by:

• Autonomous exploits: The model identifies zero-day vulnerabilities in common operating systems and browsers and generates functional exploits within a few hours.
• Massive scaling: In a benchmark conducted by Anthropic, the model developed 181 functional exploits – compared to just two for the previous model.
• Availability: Experts assume that similar capabilities will be available within six months in the open-source community and among state actors worldwide.

The defender’s lead: Project Glasswing

Under the name “Project Glasswing,” Anthropic has made the Claude Mythos model available in advance to an exclusive group of organizations working on business-critical software.

The principle: defenders gain access before attackers do. Our manufacturing partners  Cisco, Splunk, Palo Alto Networks, Fortinet, AWS, Broadcom and Microsoft are also among the organizations that are already actively using Claude Mythos to test their solutions, to fix vulnerabilities faster, and to incorporate the findings directly into their development processes.

 Cisco & Splunk: Official „Project Glasswing“ member

Anthony Grieco, SVP & Chief Security & Trust Officer at Cisco emphasizes the importance of this proactive phase. Cisco is conducting extensive testing of Claude Mythos against their own infrastructure. In addition, the importance of collaboration across organizational boundaries is highlighted:

„What gives me confidence is not the technology; it is the community.“

“We have succeeded by sharing threat intelligence, raising the alarm when needed, and showing up for each other when the stakes are highest. That is what Project Glasswing represents.“

Palo Alto Networks: „Project Glasswing“ & OpenAI’s „Trusted Access for Cyber“

Lee Klarich, Chief Product and Technology Officer at Palo Alto Networks warns against drastically shortening response times. Additionally, he emphasizes the necessity to prepare now:

„AI-assisted threats have collapsed the attack window to just 25 minutes.“

„Within six months, advanced AI models with deep cybersecurity capabilities will become commonplace.“

How NTS takes action

NTS Services, and NTS Defense Services in particular, have been consistently focused on agility from the very beginning. Building on established vulnerability and patch management processes, we make sure that we align with the new cadence:

• Increased patch cycles: We are prepared for more frequent security updates to ensure that our customers’ systems remain up-to-date and protected at all times.
• Holistic protection: Beyond mere patching, we rely on proven concepts such as the need-to-know principle, consistent network segmentation, and real-time monitoring by our SOC.
• Vendor validation: We maintain direct communication with our manufacturers to incorporate the latest developments and insights at an early stage.

NTS recommendation: “Security homework“

The necessary measures are not fundamentally new, but their implementation is more urgent. Specific recommendations for action are as follows:

1. Accelerate patch management: Critical patches should ideally be assessed and installed within 48 hours.
2. Complete the asset inventory: Only what is known can be protected – this also includes indirect software dependencies.
3. Minimize the attack surface: Reduce externally accessible services to the absolute minimum.
4. Resilience through segmentation: Prevent that a successful automated attack is able to spread laterally across the network.
5. Consistently implement multi-factor authentication (MFA): Compromised login details remain the most common attack vector. MFA is the most effective single measure to counter this.
6. Using CIS Controls as a framework: The CIS Critical Security Controls provide a prioritized, field-tested catalog of measures. In particular, the fundamental controls—hardware and software inventory, secure configuration, vulnerability management, administrator rights, and logging—address the most pressing risks in the current threat landscape.

What’s next?

Despite the current challenges, this technology will enable software to be written in the long run with greater security from the bottom up, once such models are integrated into the Secure Software Development Lifecycle (SSDLC) process. The current challenges also confirm that a solid foundation in cybersecurity and risk management is more important than ever. Additional details can be found in the media monitoring report by CERT.

Your NTS contact persons are always available to answer questions and to help with the detailed coordination of your security strategy.

Disclaimer: This statement reflects our current knowledge level as of the date of its preparation. Due to the extraordinary dynamic in the field of artificial intelligence and the constantly evolving threat level, we cannot guarantee the future completeness or continued validity of the assessments made herein. An absolute security against novel, AI-enabled attack scenarios cannot be guaranteed, despite the utmost care and most modern protection concepts.