Project Glasswing

HackerOne's Project Glasswing ran Anthropic's Claude Mythos 5 against its production codebase for 30 days, surfacing a critical remote code execution vulnerability that emerged only when three separately safe commits combined. The exercise revealed both the model's expanded detection capability and the operational bottleneck of validating and remediating what it finds.