Anthropic Project Glasswing expands to about 150 organizations after partners found 10,000 high or critical flaws. Read the security brief.
What Project Glasswing is expanding
Anthropic’s Project Glasswing is broadening security access so more organizations can probe systems built around its models under clearer rules and tooling. The program now covers about 150 organizations. That scale matters because security work on AI products is not a one-time audit: models, tools, and integrations change, and the attack surface moves with them. Wider access gives more independent eyes the chance to test prompt injection, data exfiltration paths, tool misuse, and privilege boundaries before those issues show up in production.
Expansion after a large haul of high and critical findings is a signal that partner testing is producing real defects, not just theoretical risk notes. When partners report roughly 10,000 high or critical flaws, the useful takeaway is not the headline number alone—it is that coordinated access can surface issues that internal review and automated scans miss. Severity-tagged volume also forces prioritization: critical items that enable unauthorized access or data loss should outrank medium-severity style or latency problems.
Why high and critical findings change the process
High and critical flaws typically map to paths an attacker can use with limited prerequisites: leaking system prompts or user data, bypassing safety or auth checks, escalating tool permissions, or chaining model outputs into unsafe actions. At that severity, the response loop should look like traditional product security: reproduce, assign an owner, ship a fix or mitigation, and retest. Treating every model quirk as research-only noise is how serious issues stay open.
For teams consuming or building on Anthropic-related systems, the partner results are a reminder to wire AI components into the same vulnerability lifecycle as any other service. That means clear severity definitions, SLAs for critical fixes, regression tests for known abuse patterns, and a path for external researchers or partners to report issues without waiting for a public incident. The 10,000-issue signal from partners shows that structured access produces a backlog that needs triage capacity, not just a press-friendly bug count.
How organizations can use broader access well
If your organization gains or already has access under an expanded program like this, treat it as a controlled red-team channel, not a free-for-all. Scope which products, environments, and data classes are in bounds. Separate production credentials from test keys. Log model calls and tool invocations so you can reconstruct how a flaw was reached. Document what “high” and “critical” mean in your environment so partner findings map cleanly to your risk register.
- Map each finding to a concrete asset: model endpoint, tool, plugin, or data store.
- Prefer mitigations that fail closed (deny tool use, strip secrets, require human approval) over soft filters that models can be steered around.
- Retest after model or policy updates; severity can reappear when behavior shifts.
- Share sanitized patterns internally so app teams stop shipping the same footguns.
What to do if you are outside the program
Even without Project Glasswing access, the expansion and the partner findings are a practical checklist. Assume high-impact issues exist around prompt boundaries, tool calling, and data flow until you prove otherwise. Run abuse cases against your own integrations: can a user force a tool call with another user’s context? Can instructions in untrusted content override system policy? Do error messages or logs leak secrets? Put those checks in CI and in release review for any AI-facing feature.
Read the security brief with an engineering lens: what classes of flaws partners found at scale, what access model enabled that discovery, and which of those classes apply to your stack. Use that to decide where to spend limited security time—usually authentication around tools, least privilege for agent actions, and isolation of untrusted content—rather than chasing every novel demo. Broader access for about 150 organizations raises the bar for everyone else only if the rest of the industry copies the discipline: structured testing, severity-driven fixes, and continuous revalidation as models and products change.