Does Frontier AI Strengthen Cyber Defense? Evidence from Project Glasswing
Authors: Thomas Mosk
Abstract
Defenders and attackers race to find the same software flaws. I use the launch of Project Glasswing, which gave a small group of large US tech firms early access to Claude Mythos Preview, a model for finding software vulnerabilities, to study how access to frontier AI affects defenders, external researchers, and attackers. Using the universe of publicly disclosed vulnerabilities, I find that firms with access more than doubled their disclosures relative to Chinese and Russian tech firms without access, disclosed about 150 percent more high-impact vulnerabilities, and fixed reported flaws as quickly as before. As treated firms found more flaws themselves, external researchers, who sell their findings through bug bounties, reported about half as many vulnerabilities in treated firms' code and more in other firms' code, without leaving the market. There is no evidence that attackers exploited the additional vulnerabilities: the share exploited within a month of disclosure fell by about two thirds, mainly because a smaller share was already exploited when disclosed, while the number exploited did not change. Frontier AI helped defenders find and fix more flaws before attackers exploited them, but its restricted release creates an asymmetry in software security between firms in different countries.
The papers around it, by date and closeness
Higher is closer to this paper; left is older. Lines join papers close to each other: groups of lines are sub-topics. Select a point to see why it is there. Back to the summary of this paper
Papers around this one
Ranked by how close their title and abstract are to this paper’s. Select some to read them together.
Closest papers
-
Does AI Help Cyber Attackers or Defenders? Evidence from Nonpublic Vulnerabilities and Subsequent AttacksTobias Heldt, Matthew Turk, Christoph R. Landolt et al. · 2026 · Not summarized yet
The study tests AI models on private vulnerabilities for exploit generation, repair, and attacks, while this paper estimates firms’ real-world outcomes after frontier-model access.
Abstract
The release decision for frontier AI systems increasingly relies on cyber capability benchmarks, yet public vulnerability benchmarks can expose agents to previously published advisories, exploits, and fixes, making it difficult to distinguish prior exposure from capability on unseen vulnerabilities. We evaluate open-weight and proprietary AI models on exploit generation, vulnerability repair and subsequent attacks in five nonpublic software environments, including vulnerabilities we privately disclosed while they remained unpatched. Researcher-developed and reviewed deterministic graders, not LLM judges, determine task scores. Comparisons with 209 disclosed vulnerabilities and cryptographic …
-
The Safety Exposure Paradox: How Frontier AI Safety Research May Amplify Cyber Risk in Financial InfrastructureAbena Primo, Azubike Okpalaeze, Al Amin et al. · 2026 · Proceedings of the 7th National HBCU Blockchain, Fintech & AI Conference · Not summarized yet
The case study examines whether frontier-AI safety disclosures expose offensive capabilities, rather than measuring firms’ vulnerability discovery and exploitation outcomes.
Abstract
Frontier artificial intelligence laboratories now publish detailed accounts of how their models behave under adversarial pressure: red-team transcripts, capability thresholds, interpretability findings, and responsible-scaling frameworks. These disclosures are widely treated as safety infrastructure, built to keep dangerous capabilities contained and visible to regulators. This paper argues that the same disclosures can function as a second, less examined kind of infrastructure: a map of where a model’s offensive ceiling sits, available to anyone willing to read it. Using a comparative case study of the published capability-disclosure frameworks of Anthropic, OpenAI, and Google DeepMind, thr…
-
ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?Zhun Wang, Nico Schiller, Hongwei Li et al. · 2026 · Cryptography and Security · preprint, not peer reviewed · cited 41 times · AI summary available
ExploitGym evaluates agents’ ability to turn vulnerabilities into attacks, whereas this paper studies disclosure and exploitation outcomes after firms gain AI access.
Abstract
AI agents are rapidly gaining capabilities that could significantly reshape cybersecurity, making rigorous evaluation urgent. A critical capability is exploitation: turning a vulnerability, which is not yet an attack, into a concrete security impact, such as unauthorized file access or code execution. Exploitation is a particularly challenging task because it requires low-level program reasoning (e.g., about memory layout), runtime adaptation, and sustained progress over long horizons. Meanwhile, it is inherently dual-use, supporting defensive workflows while lowering the barrier for offense. Despite its importance and diagnostic value, exploitation remains under-evaluated. To address this g…
-
Defensive Sufficiency in a Stackelberg Model of AI SecuritySubhabrata Majumdar, Rajlakshmi Chavan · 2026 · Not summarized yet
The model analyzes when discovery feedback and repairs sufficiently defend AI systems, while this paper measures vulnerability discovery and remediation at firms.
Abstract
Feedback from automated testing, human red teaming, and incident response can strengthen an AI system's defenses when discovered failures lead to effective repairs. We study when this feedback process provides sufficient protection and when investing in it is economically worthwhile. We begin by showing that an attack surface composed of finite number of inputs is defended with probability 1 if every unresolved attack has a persistent chance of discovery, repairs are effective, and subsequent updates preserve earlier protection. We derive completion-time bounds and extend the analysis to growing attack surfaces, repairs that generalize across related attacks, and multiple discovery mechanism…
-
Adopting AI, inviting risk? An empirical analysis of corporate cybersecurity consequences in IT firmsWei Xiao, Shan Xu, Jin Li et al. · 2026 · Electronic Markets · Not summarized yet
The empirical analysis examines corporate cybersecurity consequences of AI adoption in IT firms, overlapping with this paper’s study of AI access and firm defense.
-
CyberDual: AI Attackers versus AI Code Reviewers in Real Software MaintenanceChenyuan Yang, Hwiwon Lee, Jongseong Kim et al. · 2026 · Not summarized yet
CyberDual tests AI attackers and reviewers on vulnerabilities hidden in real software maintenance, rather than measuring organization-level effects of frontier-AI access.
Abstract
Open-source projects now let AI agents review incoming code, but the code under review may itself come from an AI attacker. We present CyberDual, an arena for this dual role of AI: attacker agents hide an exploitable bug in real maintenance work on widely used open-source projects, and reviewer agents try to find and repair it. Execution decides each match: we rerun the attacker's proof of concept (PoC) on the code that comes out of review. Every attack is new, and the windows can be rebuilt each quarter from the latest upstream history. Three agentic reviewers catch 85-91% of 1,088 valid attacks from six attackers. Yet when the attacker spreads the bug over real upstream commits, about one …
-
Ten AI Stepping Stones for CybersecurityRicardo Morla · 2019 · Cryptography and Security · preprint, not peer reviewed · cited 3 times · Not summarized yet
The paper surveys ten established AI-and-cybersecurity issues for practitioners, while this paper provides an empirical study of frontier AI and cyber defense.
Abstract
With the turmoil in cybersecurity and the mind-blowing advances in AI, it is only natural that cybersecurity practitioners consider further employing learning techniques to help secure their organizations and improve the efficiency of their security operation centers. But with great fears come great opportunities for both the good and the evil, and a myriad of bad deals. This paper discusses ten issues in cybersecurity that hopefully will make it easier for practitioners to ask detailed questions about what they want from an AI system in their cybersecurity operations. We draw on the state of the art to provide factual arguments for a discussion on well-established AI in cybersecurity issues…
-
CWE-bench: Refocusing Agentic Security from Exploitation to DefenseGonzalo Gonzalez-Pumariega, Ajay Jagannath, Adit Jain et al. · 2026 · Not summarized yet
CWE-bench evaluates agents auditing and repairing software weaknesses, whereas this paper estimates the effects of frontier-AI access on firms’ vulnerabilities.
Abstract
Cybersecurity evaluations of AI agents have focused largely on offense, yet a working exploit does not show that an agent can make software safe. An attacker needs to exploit only one vulnerability; a defender must find and fix all of them. We introduce CWE-bench, a private benchmark of 120 held-out repository audit-and-repair tasks spanning 73 CWE types, eight languages, and all OWASP Top 10 2025 categories. Agents are given a repository to audit and a description of its threat model, but are not told the weakness, where it occurs, or how many vulnerable sites there are. Each patch must block the exploit while preserving original functionality, as checked by a programmatic verifier. We vali…
Prior work it builds on
-
CyberGym: Evaluating AI Agents' Real-World Cybersecurity Capabilities at ScaleZhun Wang, Tian-Neng Shi, Jing-Xuan He et al. · 2025 · International Conference on Learning Representations · cited 112 times · Not summarized yet
CyberGym supplies a benchmark of real-world vulnerabilities for evaluating AI agents; this paper cites it while using public disclosure records to study firms.
Abstract
AI agents have significant potential to reshape cybersecurity, making a thorough assessment of their capabilities critical. However, existing evaluations fall short, because they are based on small-scale benchmarks and only measure static outcomes, failing to capture the full, dynamic range of real-world security challenges. To address these limitations, we introduce CyberGym, a large-scale benchmark featuring 1,507 real-world vulnerabilities across 188 software projects. Adjustable to different vulnerability analysis settings, CyberGym primarily tasks agents with generating a proof-of-concept test that reproduces a vulnerability, given only its text description and the corresponding codebas…
-
Does information security attack frequency increase with vulnerability disclosure? An empirical analysisA. Arora, Anand Nandkumar, Rahul Telang · 2006 · Inf. Syst. Frontiers · cited 115 times · Not summarized yet
The empirical analysis of vulnerability disclosure and attack frequency addresses a question this paper revisits when assessing exploitation after disclosure.
-
The Effects of Generative AI on High-Skilled Work: Evidence from Three Field Experiments with Software DevelopersKevin Cui, Mert Demirer, Sonia Jaffe et al. · 2026 · Management Sciences · cited 212 times · Not summarized yet
The field experiments estimate generative AI’s effect on software-developer productivity, providing related evidence on AI adoption that this paper cites.
Abstract
This study evaluates the effect of generative artificial intelligence (AI) on software developer productivity via randomized controlled trials at Microsoft, Accenture, and an anonymous Fortune 100 company. These field experiments, run by the companies as part of their ordinary course of business, provided a random subset of developers with access to an AI-based coding assistant suggesting intelligent code completions. Although each experiment is noisy and results vary across experiments, when data are combined across three experiments and 4,867 developers, our analysis reveals a 26.08% increase (standard error: 10.3%) in completed tasks among developers using the AI tool. Notably, less exper…
-
Before we knew it: an empirical study of zero-day attacks in the real worldLeyla Bilge, Tudor Dumitras · 2012 · Conference on Computer and Communications Security · cited 777 times · Not summarized yet
The empirical study of real-world zero-day attacks provides related evidence on exploitation timing that this paper cites.
-
Are Markets for Vulnerabilities Effective?S. Ransbotham, Sabyasachi Mitra, Jon Ramsey · 2012 · MIS Q. · cited 134 times · Not summarized yet
The study of vulnerability markets provides context for this paper’s analysis of external researchers who sell vulnerability findings through bug bounties.
Go further
How are these papers found?
We compare the title and abstract of this paper with those of every paper summarized on this site, and with the papers Semantic Scholar recommends, those it cites and those citing it (for a much-cited paper, its most recent citations and, from OpenAlex, the most cited ones). Among the prior work and the follow-ups, the papers that use each other in depth, a method it uses and the much-cited follow-ups come a little higher. The levels (very close, close, related) come from the similarity of the texts, not from a judgment of quality; * marks a paper without an abstract, compared by its title. The sentence under a paper is written by an AI from the two abstracts: check it in the papers. A paper marked not relevant by three readers leaves the list.
Updated on 9 November 2026.