This Insight interrupts our scheduled series. The announcement of Project Glasswing on 7 April 2026 crystallises a structural challenge I have been writing about for two years: your organisation's cyber resilience is determined, in part, by the weakest participant in your ecosystem. That problem just became urgent.
On 7 April 2026, Anthropic announced Claude Mythos Preview, an unreleased general-purpose AI model with cybersecurity capabilities that the company describes as surpassing all but the most skilled human security researchers.
The results are striking. In a matter of weeks, Mythos Preview autonomously identified thousands of previously unknown, high-severity vulnerabilities across every major operating system and every major web browser. It found a 27-year-old flaw in OpenBSD, an operating system renowned for its security hardening. It discovered a 16-year-old vulnerability in FFmpeg, a media library embedded in countless applications, in a line of code that automated testing tools had executed five million times without detecting the problem. It chained together multiple vulnerabilities in the Linux kernel to escalate from ordinary user access to complete control of a machine.
These are not theoretical demonstrations. These are real flaws in production software that billions of people depend on every day, discovered autonomously by a model that was not specifically trained for cybersecurity. Its capability is a by-product of strong reasoning and coding skills.
That last point matters. Mythos Preview is a general-purpose model. Its cyber capabilities emerged from advances in reasoning, not from narrow security training. Which means that as AI models continue to improve at coding and reasoning, these capabilities will proliferate. Anthropic has said this plainly: it will not be long before similar capabilities exist beyond actors committed to deploying them safely.
For directors who have followed the cyber threat landscape through annual threat reports and board briefings, the significance is this: the cost, effort, and expertise required to find and exploit software vulnerabilities has dropped dramatically, and it is about to drop further. The asymmetry that has historically favoured well-resourced attackers over most defenders is accelerating.
Here is the part that should interest every director, regardless of whether you work in technology.
Anthropic built a model with extraordinary commercial potential. They are reportedly considering an IPO as early as late 2026. Releasing Mythos Preview broadly would generate significant revenue, industry acclaim, and competitive advantage at exactly the moment it would matter most to their business.
They chose not to.
Instead, Anthropic launched Project Glasswing: a defensive cybersecurity coalition with Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks, along with more than 40 additional organisations that build or maintain critical software infrastructure. Anthropic is committing up to US$100 million in model usage credits and US$4 million in direct donations to open-source security organisations.
The logic is straightforward. Mythos-class capabilities are coming regardless. Rather than release the model and hope for the best, Anthropic is giving defenders a head start. The founding partners are using Mythos Preview to find and fix vulnerabilities in the foundational systems that represent a very large share of the world's shared cyberattack surface, including operating systems, browsers, cloud infrastructure, and open-source libraries. Anthropic has committed to publishing what it learns within 90 days so the broader industry can benefit.
Someone at Anthropic asked the question that matters: not "can we release this?" but "should we, and if so, when and how?"
That is a governance outcome. A commercially inconvenient, strategically disciplined governance outcome.
The Glasswing announcement lands barely six weeks after a very different governance decision played out in public.
In late February 2026, Anthropic's negotiations with the US Department of Defense broke down. The company insisted on restrictions preventing the use of its AI for mass domestic surveillance or fully autonomous weapons. The Pentagon labelled Anthropic a supply-chain risk, a designation typically reserved for foreign adversaries. The US President directed federal agencies to stop using Anthropic's technology.
Hours later, OpenAI announced it had signed a contract with the same Department for deploying AI in classified environments. By OpenAI CEO Sam Altman's own admission, the deal was rushed. He described it publicly as having looked "opportunistic and sloppy." The company subsequently amended the contract to include restrictions similar to those Anthropic had originally demanded.
I am not suggesting that military applications of AI are inherently wrong. That is a separate and important debate. What I am observing is the contrast in governance posture between two organisations operating in the same industry, facing the same commercial pressures, at the same moment in time.
One company held a position at significant commercial cost, was punished for it, and then six weeks later demonstrated the same governance discipline by choosing not to release its most capable model. The other rushed to fill the gap, admitted it was a mistake, and then retrofitted the safeguards.
For directors who spend time thinking about organisational culture and governance frameworks, the pattern is instructive. The decisions an organisation makes when the commercial incentives point the other way reveal more about its governance than any policy document.
Project Glasswing is the right initiative at the right time. It is also, by design, limited in scope.
The founding partners are among the largest technology and cybersecurity companies in the world. The additional 40-plus organisations maintain critical software infrastructure. Between them, they cover a significant portion of the software that underpins global commerce, communications, and critical infrastructure.
The assumption, and it is a reasonable one, is that these organisations will harden their products using Mythos Preview. The security improvements will flow downstream to every organisation using those platforms, operating systems, browsers, and cloud services. In time, the major cybersecurity vendors (CrowdStrike, Palo Alto Networks, Microsoft, and others) will integrate Mythos-class capabilities into the tools that enterprises already use. One analysis suggests this capability gap between Glasswing participants and the broader market could close within 12 to 18 months.
That is the optimistic reading. Here is the more challenging one.
There are three categories of organisation emerging from this moment.
The first: organisations whose cybersecurity vendors are Glasswing partners or who move quickly to integrate Mythos-class capabilities. These organisations will benefit, potentially significantly, from AI-augmented vulnerability discovery and defence. Their exposure to known and unknown vulnerabilities in core infrastructure will reduce materially.
The second: organisations whose vendors are slow to adopt, choose a different path, or simply lack the resources to integrate these capabilities. Smaller cybersecurity vendors, niche industry-specific software providers, legacy systems maintained by companies with limited R&D budgets. These organisations will be defending against adversaries who, increasingly, have access to tools at or near Mythos-class capability, with defences built for a pre-Mythos threat landscape.
The third, and this is the twist: organisations that fall squarely in the first category but whose supply chain, outsourced service providers, or critical third parties fall into the second. Your defences may be strong. Your cyber tools may be best-in-class. But if the business you depend on for logistics, payroll processing, customer data management, or any other critical function is breached because their defences were not upgraded, you are in crisis. Not a cyber crisis. A business continuity crisis.
This is not a new argument. I have written previously about cyber inequity and the weakest link in the ecosystem. What Mythos does is compress the timeline. The gap between well-defended and poorly-defended organisations is about to widen, and the consequences of being on the wrong side of that gap, or being connected to someone who is, have become more severe.
For not-for-profit organisations, small and medium enterprises, and organisations operating in sectors where cybersecurity has historically been under-invested, the honest assessment is sobering.
Most of these organisations do not choose their cybersecurity tools based on whether the vendor is a Glasswing partner. Most do not have the in-house capability to evaluate whether their software supply chain has been hardened against Mythos-class threats. Many rely on a single IT provider or managed service provider whose own tooling decisions are opaque.
The practical reality is that these organisations are dependent on the industry doing the right thing. They need the major platform providers, open-source maintainers, and cybersecurity vendors to harden the infrastructure they all share. And they need their own software and service providers to adopt those improvements promptly.
That dependency is not unique to cybersecurity. It is the same structural dynamic we see in financial regulation, aviation safety, and food standards. Individual participants cannot independently verify the safety of every component in the system. They rely on a combination of industry standards, regulatory oversight, and the good faith of participants further up the supply chain.
The encouraging aspect of Glasswing is that the right organisations are at the table. The Linux Foundation's involvement is particularly important, because open-source software constitutes the vast majority of code in modern systems, and its maintainers have historically had the least access to sophisticated security resources. Anthropic's direct funding to the Apache Software Foundation, Alpha-Omega, and the Open Source Security Foundation is a meaningful step toward closing that gap.
But it is a step, not a solution. The organisations most exposed to Mythos-class threats are, almost by definition, the organisations least equipped to respond.
If you are a director or executive, the Glasswing announcement is a prompt for a specific set of conversations with your management team and your cyber advisers. These are not technical questions. They are governance and risk management questions. Start with your business, not your technology.
First, know what a severe cyber event costs your organisation. If you have not conducted a business impact analysis that quantifies the operational, financial, and reputational consequences of a major cyber incident, now is the time. Not a generic risk register entry. A scenario-based assessment that identifies which business processes are critical, what their dependencies are, and what the cost of disruption looks like over days, weeks, and months. You cannot make informed governance decisions about cyber investment, insurance, or risk appetite without this foundation. If your board has not seen a current BIA, that is the first conversation to have.
Second, understand how sensitive your business outcomes are to third-party disruption. Your BIA should not stop at your organisation's boundary. Map the critical third parties your business depends on: the providers of essential services, data, systems, and infrastructure. Then ask the uncomfortable question: if one of those providers were breached and their operations disrupted for an extended period, what happens to the business outcomes you identified in the first step? Not just data exposure. Operational disruption. If your widget provider's business goes down, can you get your widgets? The probability of a severe third-party breach just increased. Your assessment of that exposure needs to be dynamic, not a point-in-time onboarding exercise.
Third, test your recovery assumptions against a faster threat landscape. Most business continuity and disaster recovery plans were designed for a world where sophisticated cyber attacks required significant attacker resources and time. Mythos-class capabilities compress that timeline. Your recovery plans need to account for the possibility that attacks become more frequent, more sophisticated, and harder to detect. Ask management: if our defensive tools are outpaced by the threat, how quickly can we detect, contain, and recover? Where are the single points of failure? What is the realistic recovery time, not the aspiration?
Fourth, get visibility over your defensive tooling and your open-source exposure. Two related questions for your technology and security teams. On tooling: which cybersecurity vendors does your organisation rely on, and are they integrating AI-augmented vulnerability discovery? This is not about demanding that your vendor use Mythos specifically. It is about understanding whether the tools protecting your organisation are keeping pace with the threat landscape. On open-source: what open-source components are embedded in your critical systems, and are the maintainers of those components receiving the benefit of Glasswing-style security efforts? Open-source software constitutes the vast majority of code in modern systems. If the answer to either question is "we don't know," that is itself a finding.
Fifth, watch the 90-day mark. Anthropic has committed to reporting publicly on what Glasswing has found within 90 days. That report will be one of the most significant cybersecurity disclosures in recent memory. When it lands, your board should receive a briefing on what it means for your organisation's risk profile. Put it in the calendar now.
Project Glasswing is a commendable initiative. Anthropic's restraint in choosing not to release Mythos Preview broadly, and the industry's willingness to collaborate around a shared defensive effort, is precisely the kind of response this moment demands.
But Glasswing does not solve the ecosystem problem. It addresses the supply side: hardening the platforms, operating systems, browsers, and security tools that the largest organisations depend on. The demand side, whether every organisation in the chain actually adopts those improvements in time, remains a governance challenge.
For directors, the takeaway is not that Glasswing will protect you. It is that Glasswing creates a window of opportunity for well-governed organisations to get ahead of a threat that is accelerating faster than most boardrooms appreciate. The question is whether your organisation, and the organisations you depend on, will use that window.
The decisions that matter most in governance are rarely about the technology itself. They are about how leaders respond when the landscape shifts beneath them. The landscape just shifted.
Related Insights:
Cyber Inequity and the Weakest Link (forthcoming, June 2026)
The Real Cost of a Cyber Incident: What the Research Tells Directors (forthcoming, April 2026)
I use AI. Deliberately, and without apology.
Every insight, argument, and position in this post is mine: drawn from 20+ years of governance practice, client work, and hard-won experience in boardrooms and organisations across Australia. The ideas, the judgements, the professional reputation behind them — that is entirely human.
What AI contributes is craft: language, structure, fact-checking, and the kind of editorial discipline that turns a practitioner's thinking into something worth reading. I bring the substance. AI helps me express it clearly.
This is a partnership, not a shortcut. I would not publish anything I could not defend in a boardroom without notes.
I believe transparency about AI use is itself a governance practice. So I will always tell you.