Does Frontier AI Strengthen Cyber Defense? Evidence from Project Glasswing

Thomas Mosk

AI summary · arXiv: 2611.06629v1 · econ.GN

Does Frontier AI Strengthen Cyber Defense? Evidence from Project Glasswing

Thomas Mosk

Original paper Submitted to arXiv on 04 Nov. 2026 License: NONEXCLUSIVE-DISTRIB 1.0 Also in: fr

How to read this summary? Illustrated guide

The essentials

Project Glasswing access to Claude Mythos Preview more than doubled participating firms’ vulnerability disclosures without detectable slower remediation or increased exploitation of the additional flaws.

Question

Does access to frontier AI improve firms’ cyber defense, and how does it affect independent vulnerability researchers and attackers? The paper also examines whether increased disclosure creates greater exploitation risk.

Method

The study combines public vulnerability records, severity and weakness data, researcher credits, remediation information, and exploitation catalogs. It compares 13 Glasswing firms with 267 Chinese firms using firm-month difference-in-differences, analyzes 7,237 external researchers by their pre-launch exposure to Glasswing code, and examines exploitation outcomes against Chinese and large non-Chinese comparison firms.

Findings

Result Glasswing firms’ disclosures rose by about 120% relative to Chinese firms, equivalent to roughly 36 additional vulnerabilities per firm per month.
See the passage in the paper
Column (1) shows that the Glasswing firms’ disclosures rose by 0.784 log points relative to the Chinese firms, an increase of about 120%. At the Glasswing firms’ pre-launch mean of 29 vulnerabilities per firm and month, the estimate corresponds to about 36 additional disclosures per firm and month.
Result The increase covered severe and remotely exploitable flaws, while the measured time to remediate reported vulnerabilities did not increase.
See the passage in the paper
The rise was largest for high-impact vulnerabilities, which increased about two and a half times, and vulnerabilities that can be exploited remotely without credentials and those present in many releases rose broadly in line with all disclosures.
Result External researchers reported fewer vulnerabilities in Glasswing firms’ code and more in other vendors’ code, without a detected change in their probability of being active.
Result The additional disclosures were not accompanied by a detected increase in the number of exploited vulnerabilities; the share exploited soon after disclosure fell, largely alongside fewer zero-day vulnerabilities among disclosures.
See the passage in the paper
The number of exploited vulnerabilities distinguishes the two, and it did not change relative to the large non-Chinese firms (Appendix Table A11): neither the number exploited within one, two, or three months of publication nor the number of zero-day or n-day exploitations moved significantly.
Authors’ interpretation The author interprets the pattern as evidence that frontier AI helped defenders discover latent flaws before attackers used them, while warning that the results do not establish that pre-emption reduced the number of zero-days.
See the passage in the paper
The evidence so far therefore shows that the flaws added by AI access were latent flaws that attackers were not using, which is the premise of pre-emption, but not pre-emption itself: the number of Glasswing zero-days did not change (Appendix Table A11).

Limitations

The study measures publicly disclosed vulnerabilities rather than the underlying stock of flaws or all discoveries, and disclosure counts also depend on validation and publication decisions.
See the passage in the paper
I observe disclosed vulnerabilities rather than the underlying stock of flaws or the total number discovered, and disclosure counts reflect discovery, validation, and the decision to publish.
Nonrandom selection into Glasswing and the use of Chinese firms as the main comparison group mean the estimates compare access to Mythos with other available AI tools, not AI with no AI.
See the passage in the paper
Because Anthropic chose the firms with access and the main comparison group consists of Chinese firms operating under different disclosure rules, the estimates measure access to Mythos Preview relative to the AI tools available to these firms, not the effect of AI relative to no AI
The paper observes vendor remediation, not whether or when users installed fixes, so it cannot establish the security status of software in use.
See the passage in the paper
Finally, observing vendor fixes does not show whether or when users installed the patches, so the results concern disclosure and vendor remediation rather than the security of software in use.

Why it matters

The authors argue that frontier AI can shift the vulnerability-discovery race toward defenders, with independent researchers reallocating effort to other code rather than leaving the market. But restricted access can create a geopolitical security gap, and the results leave open how long that gap persists and what happens when attackers obtain comparable models.

Written by AI from the paper. Passages are checked word for word against the text we analysed; the rest may contain errors.

AI-generated keywords: AI cybersecurity; vulnerability disclosure; Project Glasswing; external security researchers; cyber exploitation

Read further

Comprehensive Summary
Layman's Summary
Blog article
Original abstract

The paper asks whether access to a highly capable AI model improves firms’ cybersecurity overall, rather than merely increasing the number of flaws they report. It studies Project Glasswing, launched in April 2026, through which Anthropic provided Claude Mythos Preview to selected large technology and infrastructure firms for defensive security work. Independent vulnerability researchers and firms based in, or majority-owned by entities in, China or Russia were excluded. The study examines changes in vulnerability disclosures, external researchers’ activity, and evidence of exploitation by attackers. The author compiles public vulnerability records from the CVE List and US and Chinese vulnerability databases, supplemented with data on severity, discoverers, remediation, public exploit code, and known exploitation. The firm-level analysis compares 13 Glasswing firms—including IBM, which joined in May—with Chinese firms that could not access Anthropic models. Using monthly data, the study applies a difference-in-differences design with firm and month fixed effects. It also reports event-study estimates, tests alternative comparison groups and placebo timings, and uses methods intended to address the small number of treated firms. A separate analysis tracks 7,237 external researchers, comparing post-launch activity based on how much of each researcher’s 2024 work focused on Glasswing firms. The attacker analysis measures exploitation within fixed periods after disclosure and compares outcomes with those for Chinese and large non-Chinese firms. Relative to Chinese firms, disclosures by Glasswing firms rose by 0.784 log points—about 120 percent, or roughly 36 additional vulnerabilities per firm per month compared with a pre-launch average of 29. The increase extended beyond memory-safety flaws, which AI tools can often verify relatively easily. High-impact disclosures rose by about 2.5 times, and remotely exploitable vulnerabilities requiring no credentials also increased substantially. Several findings suggest that much of the increase reflected new discoveries rather than the release of a backlog. The median time between reserving a vulnerability identifier and publishing it fell from 75 to 22 days. Internal discoveries rose eightfold, from about four to 32 per firm per month, accounting for roughly a third of the overall increase. The study found no measurable slowdown in vendor remediation or in fixes issued by Linux distributions, although it observes disclosed flaws rather than all vulnerabilities discovered. External researchers did not appear to leave the field. After the model became available, researchers whose prior work focused entirely on Glasswing code reported 57 percent fewer vulnerabilities in that code, but about two and a half times as many in code from other non-Chinese firms. Their likelihood of remaining active did not change. This pattern suggests that independent researchers shifted their efforts toward software whose vendors lacked access to the model. The study found no evidence that the additional disclosures led to more observed attacks. The share of Glasswing vulnerabilities exploited within a month fell by about two-thirds relative to Chinese firms, largely because fewer vulnerabilities were already being exploited when disclosed. Compared with large non-Chinese firms, the share exploited within three months also declined, while the number of exploited vulnerabilities did not change significantly. Exploitation is rare, however, and the estimates are imprecise. The results are consistent with defenders finding flaws that attackers had not yet discovered, but they do not establish that AI reduced zero-day attacks. The paper concludes that restricted access to frontier models can strengthen recipient firms’ defensive position and redirect external research toward other software, while widening international capability gaps. The findings are qualified by the nonrandom selection of Glasswing firms, differences in disclosure practices between those firms and Chinese controls, limited observation of access after the program’s June expansion, and the lack of data on whether users installed patches. The study also cannot measure undisclosed flaws or determine how attackers might respond when comparable models become available to them.

Does Frontier AI Strengthen Cyber Defense? Evidence from Project Glasswing

When a company reports more cybersecurity flaws, does that mean its systems have become less secure—or that its defenders are getting better at finding problems? That question sits at the heart of Thomas Mosk’s paper, “Does Frontier AI Strengthen Cyber Defense? Evidence from Project Glasswing.” The study examines whether access to a powerful AI model improves firms’ defenses, rather than simply increasing the number of vulnerabilities they disclose.

Project Glasswing began in April 2026, when Anthropic gave selected technology and infrastructure firms access to Claude Mythos Preview for defensive security work. The program did not include independent vulnerability researchers or firms based in, or majority-owned by entities in, China or Russia. That restricted access created an opportunity to study how frontier AI might affect both participating companies and the broader security ecosystem.

How the study measures change

Mosk compiled public vulnerability records from the CVE List and U.S. and Chinese databases. The records were supplemented with information on vulnerability severity, who discovered each flaw, remediation, public exploit code, and known exploitation by attackers.

The firm-level analysis compares 13 Glasswing participants—including IBM, which joined in May—with Chinese firms that could not access Anthropic models. Using monthly data, the study applies a difference-in-differences design, comparing changes at participating firms with changes among the comparison firms. It also uses event studies, alternative comparison groups, placebo timings, and methods designed to account for the small number of participating firms.

A separate analysis follows 7,237 external researchers. It compares how their activity changed depending on how much of their 2024 work had focused on Glasswing firms. The paper also examines whether newly disclosed vulnerabilities were exploited within set periods after disclosure.

More vulnerabilities—and more serious findings

After Project Glasswing launched, vulnerability disclosures by participating firms rose by 0.784 log points relative to Chinese firms—about 120 percent. In practical terms, that amounts to roughly 36 additional reported vulnerabilities per firm per month, compared with a pre-launch average of 29.

The increase was not limited to memory-safety flaws, which AI tools may be especially suited to checking. High-impact disclosures rose about 2.5 times, and remotely exploitable vulnerabilities that required no credentials also increased substantially. Together, these results suggest that the change extended to flaws with meaningful potential consequences, not just easier-to-verify bugs.

Several findings point to newly discovered vulnerabilities, rather than simply a backlog of known flaws being released. The median time between reserving a vulnerability identifier and publishing it dropped from 75 days to 22. Internal discoveries increased eightfold, from about four to 32 per firm per month, accounting for roughly one-third of the overall rise in disclosures.

The study found no measurable slowdown in remediation by participating vendors or in fixes issued by Linux distributions. That is reassuring, but it does not tell us how quickly customers installed those fixes. Nor does the analysis capture every vulnerability firms discovered: it observes flaws that became public.

External researchers shifted their focus

The increase in company-reported findings did not appear to push independent researchers out of security research. Instead, their work shifted. After the model became available, researchers whose earlier work focused entirely on Glasswing code reported 57 percent fewer vulnerabilities in that code. At the same time, they reported about two and a half times as many vulnerabilities in code from other non-Chinese firms.

Researchers’ likelihood of remaining active did not change. The pattern suggests that, when some major software vendors gained access to a powerful AI tool, outside researchers redirected attention toward software whose vendors lacked access. This is an important spillover: a program can change not only what participating firms find, but also where independent researchers look.

Did attackers exploit more of the new disclosures?

The paper finds no evidence that the additional disclosures led to more observed attacks. Compared with Chinese firms, the share of Glasswing vulnerabilities exploited within a month fell by about two-thirds. Much of that difference came from fewer vulnerabilities already being exploited at the time they were disclosed.

Against large non-Chinese firms, the share of vulnerabilities exploited within three months also declined, while the number of exploited vulnerabilities did not change significantly. Because exploitation is rare, however, these estimates are imprecise. The results are consistent with defenders finding flaws before attackers do, but they do not prove that AI reduced zero-day attacks.

What the findings do—and do not—show

Overall, the study suggests that restricted access to a frontier AI model can strengthen the defensive position of firms that receive it. It may also shift independent research toward other software, while widening differences in security capabilities between organizations and countries.

The conclusions come with important limits. Glasswing firms were not selected randomly, and their disclosure practices may differ from those of Chinese comparison firms. The study has limited information about access after the program expanded in June. It also cannot determine whether users installed patches, measure flaws that were never disclosed, or predict how attackers might respond if they gained access to comparable models.

For now, the evidence offers a measured answer to the central question: access to a highly capable AI model was associated with more vulnerability discoveries at participating firms, including more serious flaws, without a detected rise in exploitation. Whether that advantage lasts—and how it changes as access spreads—remains an open question.

Created on 09 Nov. 2026

Was this synthesis useful?

Score: 0

Ask questions about this paper to our AI assistant

How to chat with this paper? Illustrated guide

Compare with the PDF

You can also chat with multiple papers at once here.

AI assistant instructions?

Tools for this paper

Explain it differently 1 free rewrite left today

Save to a collection Group papers in collections to compare them, chat with them and export them. Continue with Google Create a free account Log in

Export BibTeX · RIS (Zotero, Mendeley, EndNote) · Obsidian (Markdown) · Notion (Markdown)

Advanced tools Premium

For researchers who follow a field closely: citation alerts, journal-club slides, version comparison and Zotero export. Discover Premium

Zotero

Citation alerts Citation alerts guide

Who works on it? The people and institutions who publish on its topic

Weekly letter Presented in "Economics and finance this week" of 9 November 2026. Economics and finance this week: When prices, protection and ownership change the rules

Journal club Premium+ Slides to present it Propose for the journal club

Versions What changed between versions

Talk about it in public Premium+ Press kit: release, questions, hype check Press kit guide

Disclaimer: The AI-based summarization tool and virtual assistant provided on this website may not always provide accurate and complete summaries or responses. We encourage you to carefully review and evaluate the generated content to ensure its quality and relevance to your needs.

Does Frontier AI Strengthen Cyber Defense? Evidence from Project Glasswing

The essentials

Question

Method

Findings

Limitations

Why it matters

Read further

Definitions

Does Frontier AI Strengthen Cyber Defense? Evidence from Project Glasswing

How the study measures change

More vulnerabilities—and more serious findings

External researchers shifted their focus

Did attackers exploit more of the new disclosures?

What the findings do—and do not—show

Ask questions about this paper to our AI assistant

Tools for this paper

Advanced tools Premium

Papers around this one

Closest papers

Prior work it builds on

Go further

Cite this paper (BibTeX)