Project Glasswing
An AI vulnerability discovery project for large security teams, helping partner organizations produce human-verifiable high- and critical-severity vulnerability reports from critical software.
Tool overview
Based on the current evidence, Project Glasswing looks more like a high-bar, selectively available AI security research initiative than a broadly purchasable enterprise security product. The adoption call should be conservative: if you are a large institutional security team that may enter Anthropic’s partner program, it is worth tracking closely; if you want a self-serve scanner, security API, or DevSecOps add-on, the evidence does not support treating it as a mature general-purpose tool. It is important to separate hype proof from usefulness proof: high-view, high-repost official X posts show strong attention, but they do not by themselves prove broad external validation, reliability, or manageable false positives.
In practical terms, Anthropic’s posts and the project lead’s thread broadly align: the project helps find high- and critical-severity vulnerabilities in important software, and across partners it has surfaced about 10,000 potential issues, with nearly 1,500 manually validated. That means it is not a traditional SAST product, and not a coding copilot for everyday developer work.