What Happens After AI Finds the Bugs?

Project Glasswing arrived like many AI announcements: an evocative name, an unreleased model, a controlled-access program, and a roster of launch partners that included Amazon Web Services, Apple, Google, Microsoft, Cisco, CrowdStrike, Nvidia, Palo Alto Networks, JPMorganChase, Broadcom, the Linux Foundation, and more. Anthropic described the project as an effort to give selected defenders secure access to Claude Mythos Preview, a model trained for advanced cybersecurity work. Its early claims were dramatic: thousands of high-severity vulnerabilities found across critical software, including flaws in open-source projects and global infrastructure code that had already been examined by conventional tools and human experts.2

There are reasons to treat those claims with caution. Project Glasswing is also a company-led product and policy narrative around a model Anthropic has not made generally available. Much of the evidence is necessarily filtered through Anthropic and its partners, some of whom are also its customers and investors, and the public cannot fully reproduce the results, compare the model under ordinary operating conditions, or measure how many findings survive independent validation over time. Even so, Glasswing is useful as a marker of where the industry is moving, because the larger trend does not rest on any single model or vendor. AI is changing the cost, speed, and scale of vulnerability discovery, and the software-supply-chain industry is being forced to absorb that acceleration.

The pressure was visible before Glasswing. In April, NIST said CVE submissions increased 263% between 2020 and 2025, and that submissions in the first three months of 2026 were nearly one-third higher than in the same period a year earlier.6 NIST also said it enriched nearly 42,000 CVEs in 2025, 45% more than in any prior year, yet still could not keep pace with the volume.6 FIRST, the Forum of Incident Response and Security Teams, initially forecast roughly 59,427 CVEs for 2026,4 then raised its mid-year projection to about 66,000.3 Those numbers do not prove AI is the sole cause of the surge, but they show the environment into which AI-assisted discovery is arriving: more reports, more triage, more ambiguity, and more pressure on defenders, often without comparable increases in defensive resources.

That is the real significance of AI-assisted vulnerability discovery. Finding a bug is only the first step in a long chain of work. A security team must determine whether the finding is real, whether it is exploitable, whether it affects deployed versions, whether a patch already exists, whether the proposed fix introduces regressions, whether disclosure should be coordinated and how, whether downstream users can identify their exposure, and whether and to what extent the update channel itself can be trusted. As models become better at generating plausible vulnerability reports, exploit sketches, patches, and test cases, they may reduce some parts of that burden while expanding others. A defender that receives ten times as many plausible findings has not solved the security problem; they have simply acquired a faster intake system.

Anthropic’s own Glasswing update points to the same bottleneck, even in the company’s favorable framing. In its May 22, 2026 update, the company said Mythos Preview had scanned more than 1,000 open-source projects and produced 23,019 findings, including an estimated 6,202 high- or critical-severity vulnerabilities.2 The validation results were strong on the subset reviewed: of 1,752 high- or critical-rated findings assessed by outside security firms or Anthropic, 90.6% were valid true positives, and 62.4% were confirmed as high or critical severity.2 But the remediation numbers were much smaller. At the time of the update, Anthropic said it had disclosed 530 high- or critical-severity bugs to maintainers, with 75 patched and 65 given public advisories.2 Anthropic cautioned that the patch count was early and likely undercounted, but the imbalance still illustrates the central problem: AI had accelerated discovery much faster than the surrounding processes for verification, disclosure, and repair.

That is where software-supply-chain security becomes more than a background concern. Faster discovery has value only if fixes can move through processes that organizations and users can trust. A patch is itself software, and it may pass through repositories, package registries, build systems, signing infrastructure, release workflows, mirrors, and update mechanisms before it reaches users. Each of those steps can introduce risk if it is poorly controlled. A compromised development or build pipeline, a malicious or substituted package, an abused signing credential, or a hijacked update mechanism can turn a legitimate remediation process into a vehicle for compromise.

The industry has spent years developing ways to reduce that risk, including artifact signing, provenance records, SBOMs, reproducible builds, repository hardening, delegated trust, rollback protection, and secure-update frameworks. Those mechanisms do not solve the whole problem, and many are difficult to implement well across large, heterogeneous engineering environments. But they become more important as vulnerability cycles accelerate. AI may help organizations find and even propose fixes faster; it does not remove the need to prove that the fix came from the right source, was built through the expected process, can be safely delivered to users and, if necessary, rolled back.

Justin Cappos, a professor at New York University whose work includes The Update Framework, Uptane, in-toto, and other secure-update infrastructure, said the pressure to move quickly after a serious vulnerability is exactly where the software supply chain can become exposed to attack. A patch may be urgently needed, but the process of delivering it can itself be hijacked if attackers compromise a repository, build process, signing key, package registry, or update channel.

“There is a tension between needing to get security fixes out quickly while also ensuring that attackers are not exploiting flaws in the software supply chain to push malware,” Cappos said in written comments for this article. “Technologies like TUF and in-toto fit into that picture because they provide a secure means to get updates out quickly and are designed with security as the primary goal.”

TUF, in-toto, Uptane, and similar frameworks are widely regarded by software-supply-chain researchers and practitioners as among the strongest available tools for securing software updates, provenance, and artifact integrity. But they are not one-size-fits-all products that can simply be switched on. They are mature building blocks that organizations have to compose around their own trust models, build systems, signing authority, release workflows, and recovery needs. As vulnerability discovery accelerates, the organizations most at risk may not be those without AI-assisted scanners, but those without the engineering capacity to turn best-in-class security tools into trusted remediation pipelines.

The tension is especially acute for open source. The Linux Foundation, one of the Glasswing launch partners, has warned that maintainers already face higher volumes of pull requests and security bug reports, many of them AI-generated, as well as sophisticated campaigns to compromise supply chains.5 Large enterprises may have security teams, release engineers, incident-response processes, and commercial tooling. A widely used open-source library may be maintained by a small group of volunteers who suddenly receive machine-generated reports about code that supports browsers, package managers, cloud systems, embedded devices, and commercial products. AI can assist those maintainers by generating tests, reproducing issues, and drafting patches, but it can also flood them with reports that require expertise, judgment, context, time, and resources to properly address.

The same operational problem takes a different form inside governments and other large institutions, where the challenge often involves inherited code, limited documentation, and years of accumulated technical debt. Anthropic’s Alberta case study said the province’s Ministry of Technology and Innovation used Claude Code to scan 466 million lines of government code in about 20 hours across roughly 1,280 applications and 3,400 repositories.1 The ministry used about 50 agents working in parallel to identify security vulnerabilities, weaknesses in infrastructure and deployment processes, and documentation gaps.1 Alberta’s implementation reportedly used a two-stage process in which Claude first flagged known patterns and then cited files and lines so developers could verify findings. Anthropic said patches were reviewed and approved by ministry engineers before shipping.

The Alberta example is useful because it shifts the framing from spectacular zero-days to ordinary institutional backlog. Governments, banks, hospitals, utilities, and large companies often run old systems with incomplete documentation, uneven test coverage, brittle deployment processes, unsupported platforms, and legacy dependencies. AI-assisted review may help those institutions understand what they actually have, find problems that traditional tools missed, generate tests where none exist, and modernize systems that are expensive to maintain. But the same example also underlines the governance problem: a tool that can review hundreds of millions of lines of code quickly still leaves human institutions responsible for risk ranking, change control, procurement, auditability, accountability, and ultimately maintaining public trust.

“AI-assisted cybersecurity is not only about speed,” said Martin Dinel, Alberta’s assistant deputy minister and chief information security officer for the Cybersecurity Division in the Ministry of Technology and Innovation, in written comments. “For governments, the value is in understanding large, complex legacy environments, identifying risk more systematically, and moving toward remediation in a way that remains accountable to citizens. The goal of the Velocity White Papers is to share what Alberta has learned so that other public-sector organizations can adapt the approach to their own systems, controls, and responsibilities.”

Dinel said public-sector organizations, especially those that have worked for decades with limited budgets, cannot treat legacy risk as secondary to the hunt for zero-days. “Unsupported, unpatched, and unmanaged legacy systems and platforms represent the biggest threat to most organizations today,” he said.

The next phase of software-supply-chain security will therefore be less about any single defensive tool than about orchestration. Discovery, validation, patch generation, testing, disclosure, artifact signing, provenance, distribution, rollback, and recovery have to function as one system. AI may make several of those steps faster, but speed without integrity can create its own failure modes. The industry will need clearer norms for AI-generated vulnerability reports, stronger maintainer support, better evidence trails from finding to fix, and update systems that assume attackers will target the remediation process itself.

Project Glasswing may prove to be a breakthrough, a public marker of work already underway, a marketing campaign, or some combination of the three. The reason to pay attention is that it points to a security transition still in its early stages. AI is making it easier to search large codebases, reason about bugs, generate candidate fixes, and operate at a scale human-only teams could not sustain. But that does not solve the old software-supply-chain problems. It puts more pressure on them. As vulnerability discovery and exploitation accelerate, the decisive question is whether validation, remediation, and trusted delivery can keep up.

1. Anthropic. Government of Alberta Uses Claude to Find and Fix Cybersecurity Vulnerabilities Across Government Systems (July 6, 2026); https://www.anthropic.com/news/alberta-government-claude-cybersecurity

2. Anthropic. Project Glasswing: An Initial Update (May 22, 2026); https://www.anthropic.com/research/glasswing-initial-update

3. FIRST. FIRST Mid-Year Vulnerability Forecast Confirms Historic Surge, Projects ~66,000 CVEs in 2026 (June 15, 2026); https://www.first.org/newsroom/releases/20260615

4. FIRST. FIRST Releases 2026 Vulnerability Report, Projecting Record-Breaking Common Vulnerabilities and Exposures (February 11, 2026); https://www.first.org/newsroom/releases/20260211

5. Linux Foundation. Introducing Project Glasswing: Giving Maintainers Advanced AI to Secure the World’s Code. (April 7, 2026); https://www.linuxfoundation.org/blog/project-glasswing-gives-maintainers-advanced-ai-to-secure-open-source

6. National Institute of Standards and Technology. NIST Updates NVD Operations to Address Record CVE Growth (April 15, 2026); https://www.nist.gov/news-events/news/2026/04/nist-updates-nvd-operations-address-record-cve-growth

Jeremy Osborn is a technology executive and strategic advisor with nearly three decades of experience spanning software engineering, cybersecurity, product development, high-tech marketing and communications, and environmental technology. His recent work focuses on software supply chain security, including STUF, an open-source framework for protocol-driven supply chain security.