Cloudflare · 2026-05-18 · major
Cloudflare Publishes Its Project Glasswing Findings — Anthropic's Mythos Preview Excelled at Chaining Exploits Across 50+ Repos but Needed a Seven-Stage Harness to Tame False Positives
Cloudflare's CSO details its Project Glasswing pilot: Anthropic's Mythos Preview built and tested working exploit chains across 50-plus internal repos, but hedged findings and false positives pushed Cloudflare to build a seven-stage agent harness.
Cloudflare shares hands-on results from using Anthropic's Mythos Preview to hunt vulnerabilities in its own code.
What is it?
Cloudflare is a partner in Project Glasswing, Anthropic's program giving select companies access to Claude Mythos Preview — an unreleased frontier model strong at finding and weaponizing software vulnerabilities. This post, by CSO Grant Bourzikas, reports what Cloudflare learned scanning more than 50 of its own repositories.
How does it work?
Cloudflare found Mythos Preview excels at exploit-chain construction, combining several bugs into a working proof-of-concept by iteratively writing, compiling, and testing exploit code rather than just flagging isolated issues. But the model gave inconsistent safety refusals, produced more false positives in memory-unsafe C/C++ code, and hedged findings with words like 'possibly.' Cloudflare responded with a seven-stage pipeline: Recon, parallel-agent Hunt, adversarial Validate, Gapfill, Dedupe, Trace, and Report.
Why does it matter?
It is one of the first detailed outside accounts of running a Mythos-class model against real production code, showing that a single agent is not enough — vulnerability research at scale needs orchestration to keep signal-to-noise usable. It gives security teams a concrete blueprint to copy.
Who is it for?
security engineers and vulnerability researchers