When Anthropic gave a small group of organizations access to a model capable of completing a complex cyberattack from beginning to end, it made a decision that was as much about governance as technology.
The model, Mythos, was not released publicly. Instead, more than 40 organizations were given controlled access through Project Glasswing, a consortium designed to direct the model’s capabilities toward defensive cybersecurity work. The underlying logic is straightforward. If an AI system can identify vulnerabilities and execute complex attack chains faster than human defenders, keeping that capability away from attackers could give defenders a critical advantage. But the same logic raises a more difficult question: can controlled access actually remain controlled long enough for that advantage to matter?
The answer depends on what happens between capability development and broader proliferation.
A different approach to dangerous capabilities
Project Glasswing represents a particular approach to AI governance. The objective is not to prevent access to a dangerous capability indefinitely. Nor is it to release the technology and rely on the market to determine its consequences. Instead, the capability is made available to a limited group of organizations under specific conditions intended to maximize defensive benefits and minimize offensive use.
The participating organizations operate under restrictions that include mandatory logging of model use, disclosure requirements for security findings, and prohibitions on offensive research. Membership is limited to organizations with demonstrated defensive cybersecurity mandates. This creates a controlled environment in which the model can be used to discover vulnerabilities, test defenses and improve security without making the same capability freely available to potential attackers.
The argument is particularly compelling in cybersecurity because offense and defense are asymmetric. An attacker may need to find only one exploitable weakness. A defender has to protect an entire system, continuously monitor it and respond to vulnerabilities across a much larger attack surface. An AI system capable of automating complex attack chains could therefore be disproportionately valuable to attackers if it were widely available.
But that is only half of the equation.
When would Glasswing be a net positive?
For Project Glasswing to produce a net benefit for cybersecurity, several conditions would need to hold simultaneously.
First, defenders would need to use the model effectively. Finding vulnerabilities is not enough. Organizations must have the resources, authority and technical capacity to fix them before attackers exploit them.
Second, the model would need to provide defenders with a meaningful time advantage.
If Mythos can identify vulnerabilities months, weeks or even days before attackers can discover and exploit them, controlled access could create a genuine defensive advantage. But if attackers obtain equivalent capabilities shortly after defenders do, the value of that lead diminishes rapidly.
Third, the information generated by the model would need to remain sufficiently contained. This does not necessarily mean preventing every leak forever. It means maintaining enough control for defensive improvements to occur before comparable offensive capabilities become broadly accessible.
Fourth, the organizations participating in Glasswing would need to behave as intended. Logging and contractual restrictions can create accountability, but they do not eliminate insider threats, compromised systems or accidental disclosure.
Finally, the defensive ecosystem would need to be able to absorb the model’s output. A system that discovers vulnerabilities faster than organizations can patch them may actually increase the volume of unresolved risk. That capacity is also unevenly distributed. Membership selects for organizations with security teams, budgets and the authority to patch, while the most exposed systems are run by organizations that would not qualify and could not act on a finding if they received one.
Under these conditions, controlled access could create a positive feedback loop: AI capability → faster vulnerability discovery → faster remediation → stronger defenses → reduced attacker advantage.
That is the optimistic scenario behind Glasswing.
When could it become net negative?
Suppose the model’s capabilities leak. An attacker gains access to the system, or an employee takes knowledge of its techniques to another organization. Alternatively, another laboratory independently develops a model with comparable capabilities. At that point, the defensive advantage begins to disappear.
The problem becomes particularly serious if offensive capabilities diffuse faster than defensive practices improve. The asymmetry is structural. Offensive knowledge travels through networks with no membership requirements. Defensive knowledge travels through one with logging, disclosure rules and a vetted participant list. The controls that make controlled access safe also make it slower than what it is racing.
The result could look like this: AI capability → faster vulnerability discovery → faster exploitation → more scalable attacks → increased systemic risk.
This is the central problem with containment.
A contract can prohibit offensive research. It cannot prevent an organization from being breached. It cannot guarantee that employees will never leave. And it cannot stop another research group from independently reaching the same technical frontier. Controlled access therefore cannot be understood as permanent containment. At best, it is a mechanism for buying time.
The value of delay
This is where the debate over Project Glasswing becomes more interesting. The fact that a capability cannot be contained indefinitely does not mean that containment has no value.
If controlled access delays widespread proliferation by one year, that year could be enormously valuable if defenders use it to develop detection systems, patch vulnerable infrastructure, improve incident response and build governance mechanisms.
But the value of the delay depends on what happens during it.
If AI capabilities advance faster than cybersecurity defenses, the delay may accomplish very little. If defensive technologies and institutions improve faster than offensive capabilities spread, the same delay could significantly reduce risk. This turns Glasswing into something resembling a race: capability development vs. defensive adaptation. The critical question is not whether proliferation can eventually be prevented. It probably cannot.
The question is whether defenders can use the period of controlled access to become sufficiently prepared before comparable capabilities become widely available.
Can we know in advance which scenario will apply?
This may be the hardest question. There is no single metric that can tell us whether Project Glasswing will ultimately be beneficial or harmful.
We can monitor indicators:
- how quickly the model finds vulnerabilities,
- how quickly organizations patch them,
- whether security incidents increase,
- whether access controls hold,
- how quickly comparable capabilities appear elsewhere and whether defensive infrastructure improves.
But these indicators only become meaningful over time.
There is also a fundamental problem of uncertainty.
The most consequential failure mode may be precisely the one that existing evaluation systems fail to anticipate.
This is why the broader International AI Safety Report’s principle of defense in depth is relevant. No individual safeguard should be expected to solve the problem. Controlled access is one layer. Logging is another. Monitoring, red teaming, vulnerability disclosure, patching, institutional governance and incident response are additional layers.
The objective is not perfect containment. It is to prevent the failure of one safeguard from becoming a catastrophic failure of the entire system.
Glasswing is a bet, not a solution
Project Glasswing should therefore be understood as a governance experiment. Its success would not demonstrate that dangerous AI capabilities can be permanently contained. It would demonstrate something more modest and potentially more useful: that controlled access can create enough defensive advantage to make the period before widespread proliferation safer.
Its failure would not necessarily mean that controlled access was irrational. It could instead demonstrate that the defensive ecosystem was unable to convert technological access into meaningful security improvements. The decisive factor is therefore not simply what Mythos can do. It is what institutions can do with the time Mythos gives them.
If defenders can translate advanced AI capabilities into faster detection, remediation and resilience, controlled access may be a net positive for cybersecurity. If offensive capabilities spread faster than defenses improve, the same technology could become a force multiplier for attackers.
Project Glasswing cannot eliminate that uncertainty.
It can only try to make sure that, while the uncertainty remains, the first move belongs to the defenders.