Glasswing study links frontier AI access to more disclosed software flaws—not fewer observed exploits

A defensive advantage under restricted access

Thomas Mosk of Queen Mary University of London examines whether access to a powerful AI model changed the race to discover software vulnerabilities. His arXiv preprint, version 1, published November 4, 2026, reports substantial increases in public disclosures by Project Glasswing firms. Its strongest evidence concerns disclosed vulnerabilities; the implications for actual attacks are less certain.

According to the paper, Anthropic launched Glasswing on April 7, 2026, giving twelve partners access to Claude Mythos Preview for defensive work. IBM joined in May. Some partners had already used the model in March. Anthropic subsequently expanded access in June, while its regional and ownership restrictions continued to exclude Chinese and Russian firms. External vulnerability researchers did not receive access.

Comparing changes, not raw totals

Mosk combines public vulnerability records, vendor advisories, researcher credits and exploitation catalogs. The main firm-level analysis compares thirteen Glasswing firms with 267 Chinese firms between October 2025 and September 2026. It asks whether disclosures changed more at Glasswing firms, accounting for persistent differences between companies and changes common to each month.

This is not a randomized experiment. Its causal interpretation requires that, without Glasswing, the groups’ disclosures would have grown at the same proportional rate. The paper reports no statistically detectable differential trend before early access and no effect from a fictitious launch a year earlier. Those checks support, but do not establish, the assumption. Chinese firms operate under different disclosure rules and have other AI tools: this is a comparison of access to Mythos against available alternatives, not AI against no AI.

More disclosures, including consequential flaws

The baseline estimate implies about 120% more disclosures relative to Chinese firms—approximately 36 additional vulnerabilities per Glasswing firm each month at the pre-launch average. High-impact disclosures increased by about 150%. Here, “high impact” means above the sample median on the damage component of a standard severity score, not simply a count of vulnerabilities labeled critical.

The increase extended beyond memory-safety bugs, which the paper identifies as especially amenable to automated verification. Disclosures also rose for complex weaknesses and flaws exploitable remotely without credentials. This supports Mosk’s interpretation that the additional output was not confined to minor or easily tested problems.

The timing of vulnerability identifiers favored new discoveries over the release of an old backlog. However, reservation dates do not reveal when a flaw was first discovered. Explicitly credited internal discoveries accounted for roughly one third of the raw increase in disclosures, while external reports also increased.

Fixes kept pace—but only where observed

The paper finds no detectable slowdown in vendors’ handling of flaws reported through the Zero Day Initiative, or in Linux distributions’ delivery of fixes for tracked vulnerabilities. That is evidence against congestion in these measured channels, not proof that remediation capacity was unlimited.

These measures concern flaws that reached disclosure and remediation. The paper cites Anthropic’s report of many more discoveries awaiting disclosure, leaving open whether fixing capacity constrained that unpublished stock. It also does not observe whether users installed available patches.

Researchers moved toward other code

A separate analysis follows 7,237 external researchers credited with discoveries in 2024. It estimates that a researcher previously working exclusively on Glasswing code reported 57% fewer vulnerabilities there after access began, while reporting roughly two and a half times as many in other non-Chinese vendors’ code. Monthly activity showed no detectable change.

This suggests reallocation rather than market exit within the tracked cohort. It does not contradict rising external reports overall: newcomers supplied much of that increase. Mosk also notes that some decline in established researchers’ Glasswing discoveries may continue an earlier drift. Credits measure output, not hours worked or earnings.

A lower exploited share is not fewer attacks

Relative to Chinese firms, the estimated share of Glasswing vulnerabilities exploited within one month fell by about 0.9 percentage points, roughly two thirds of its pre-launch rate. Most of the decline concerned vulnerabilities already exploited when disclosed. A comparison with large non-Chinese firms found a similar proportional decline over three months, although results varied by comparison group and observation window.

Crucially, the number of exploited vulnerabilities did not change significantly. Adding disclosures of previously unexploited flaws can lower the exploited share without preventing attacks. Mosk therefore treats the probability decline as suggestive, not established evidence of pre-emption. The count estimates remain imprecise and cannot exclude moderate changes. Exploitation dates record public evidence, not necessarily when attacks began, and observation windows extend only up to three months after disclosure.

The study supports a narrower conclusion than a demonstrated reduction in attacks: selected firms disclosed more potentially important flaws without a measured remediation slowdown. Whether that advantage produces lasting protection—and how it changes when attackers gain comparable tools—remains unresolved.