The Glasswing Asymmetry: Anthropic Hands Mythos to AWS, Apple, and JPMorgan While Operational Technology Waits Outside

Anthropic announced Project Glasswing in early April with the framing every AI lab now reaches for: "giving defenders a durable advantage in the coming AI-driven era of cybersecurity." Claude Mythos Preview, the company's most capable model to date, would be made available to a curated group of partners so they could find and patch latent vulnerabilities in their foundational systems before adversaries armed with similar capabilities found them first.

The launch list was not subtle. Amazon Web Services. Apple. Broadcom. Cisco. CrowdStrike. Google. JPMorgan Chase. Microsoft. Nvidia. The largest cloud providers, the largest endpoint security vendor, the largest investment bank, and the company whose silicon underwrites every frontier model. Mythos has reportedly already discovered thousands of zero-day vulnerabilities across these partners' codebases — including a 17-year-old remote code execution bug in FreeBSD's NFS implementation and a 27-year-old flaw in OpenBSD that an autonomous run identified, exploited, and reported within a single session.

What is not on the launch list is also unsubtle, once you notice it. Siemens, whose programmable logic controllers run a meaningful share of global manufacturing. Honeywell and Schneider Electric, whose distributed control systems sit inside refineries, water treatment plants, and power generation. Rockwell Automation, ABB, Emerson, Yokogawa, GE Vernova. The vendors whose firmware quietly executes on equipment whose failure modes are not "service degraded" but "the city loses water," "the substation arcs," "the boiler overpressures."

This is the Glasswing Asymmetry. Anthropic is using its most powerful cybersecurity capability to harden the cloud control plane and the financial reporting layer, and not — yet — the operational technology that actually runs the physical world. The asymmetry is rationalizable. It is also, in May 2026, the most consequential editorial choice any frontier AI lab has made about who gets defended first. The rest of this piece is about why the asymmetry exists, what it costs, and what would have to change for it to close.

What Mythos Actually Does, and Why It Matters Differently to OT

Mythos Preview is not a SAST scanner with better marketing. The Anthropic technical disclosure describes runs in which the model is given a codebase, a build environment, and a goal — find an exploitable vulnerability — and then operates in a long-horizon agentic loop: reading source, building hypotheses, writing fuzzers, instrumenting the binary, observing crashes, refining its theory of the bug, and producing a working proof-of-concept exploit when one exists. The 17-year-old NFS bug was found this way. So was a class of memory corruption flaws in widely deployed TLS stacks that had survived two decades of human review and conventional fuzzing.

The capability that matters is autonomous depth. A senior reverse engineer can find the same bugs Mythos finds. A senior reverse engineer cannot, on a Tuesday afternoon, decide to audit fifteen hundred firmware images across a vendor's product family and have a written report on the desk by Friday. Mythos can. That is the shift Glasswing partners are paying for: not "AI helps the security team," but "the security team's effective headcount goes up by an order of magnitude for the duration of the engagement."

The reason this matters more for operational technology than for cloud is structural. Cloud codebases are written, deployed, and patched on rolling weekly or daily cadences. A vulnerability found on a Monday is, in the median case, in production fixed by Friday. Operational technology runs on a fundamentally different clock. A PLC firmware revision is a regulated change. A control-system patch in a refinery requires a planned outage, change-control board approval, vendor sign-off, and often a window scheduled six to eighteen months in advance. The operating expectation in OT is that firmware deployed in 2008 may still be in production in 2028. There are real reasons for this — safety integrity level recertification, NERC CIP compliance, the simple fact that a stuck valve at 4 a.m. is a very different incident than a degraded API response — but the consequence is that the population of latent vulnerabilities sitting in production OT codebases is enormous, old, and largely unaudited.

Mythos is precisely the tool you would build to find those vulnerabilities. And Mythos is not, in May 2026, available to the people who own the codebases.

The Launch Partner List, Read Carefully

The published Glasswing partner roster, as of the May 1 update on Anthropic's research site, comprises nine organizations across four functional categories.

Three hyperscalers (AWS, Google, Microsoft) cover the substrate that almost every other organization on the list runs on. Two security vendors (Cisco, CrowdStrike) cover the network and endpoint layers that defend that substrate. Apple and Nvidia cover consumer hardware and AI silicon respectively. Broadcom sits across silicon and enterprise software. JPMorgan Chase is the lone non-tech-vendor — a financial institution whose participation is best read as a statement about systemic risk in the banking sector.

What is conspicuously absent: industrial automation vendors, utilities, water authorities, transportation operators, healthcare device manufacturers, building automation, and the entire universe of small-to-medium ICS integrators. The Department of Energy's national labs — Idaho National Laboratory, Sandia, Pacific Northwest, the cybersecurity programs that have for two decades been the public-sector equivalent of what Glasswing is offering privately — are also not partners.

The OT industry's reaction has been polite but unmistakable. Nextgov reported in early May that operational technology providers had pressed Anthropic for access during private roundtables and that the response had been a non-committal "we are evaluating expansion." A senior figure at a major automation vendor, quoted on background, described the situation as "the cloud guys getting an early look at the bug list while we wait for it to leak to the actors who don't ask permission." That is, give or take a verb, the security model the entire OT sector has lived under for fifteen years. What is new is that the asymmetry is now structural and named.

Why the Asymmetry Exists

There is no single reason and no villain. The asymmetry exists because four separate forces all push in the same direction.

The first is commercial gravity. Anthropic's customer base, like OpenAI's and Google's, is concentrated in cloud, finance, and consumer tech. The companies that buy the most Anthropic API capacity get the most attention from Anthropic's partnership team. Glasswing partners are, almost without exception, top-decile Claude consumers. OT vendors, with much smaller AI budgets and much longer procurement cycles, are not.

The second is liability geometry. A Mythos-driven finding that breaks AWS Lambda is a contained engineering incident. A Mythos-driven finding that breaks a Siemens S7-1500 PLC is potentially a city-scale physical event. The legal and reputational exposure of running an autonomous vulnerability discovery engine against critical-infrastructure firmware — even with the vendor's full consent — is, from a frontier lab's risk-committee perspective, qualitatively different from running it against a hyperscaler. The first lawsuit after a Glasswing-discovered bug accidentally bricks a controller in a chemical plant during a coordinated patching window is the kind of lawsuit that ends a research program.

The third is engineering reachability. To use Mythos productively against a target, the partner has to provide source code, build environments, executable artifacts, and ideally a representative test bench. AWS can do this in an afternoon. A typical OT vendor has a software estate composed of acquired-company codebases, third-party real-time operating systems under restrictive licenses, hardware-dependent toolchains that only build on specific Windows versions, and firmware whose original authors retired in 2014. The on-ramp cost is enormous, and Anthropic has finite engineering capacity to absorb that cost.

The fourth is information control. The findings Mythos produces are themselves dangerous artifacts. A weaponizable zero-day in a widely deployed PLC, even shared in confidence with the vendor, sits in inboxes and ticket systems and is one phishing campaign away from being exfiltrated. A vendor whose internal security maturity is below the level of, say, AWS — and most OT vendors are below that bar, not because they are negligent but because the threat model they were built for assumed network isolation that no longer exists — is a riskier partner. Anthropic's Glasswing roster reads, in part, as a list of organizations whose information-handling maturity Anthropic trusts.

These are real reasons. None of them is a defense for the resulting asymmetry, but they explain why a sensible, safety-conscious AI lab arrived at this particular partner list. The question for the rest of 2026 is whether and how those forces relax enough to extend the program to the operators of the physical world.

The Cost of Waiting

The cost of OT exclusion compounds in two directions at once.

The first compounding direction is adversary capability. The frontier model capability that makes Mythos useful to defenders is, by construction, also useful to attackers. There is no version of the world in which only the good guys have access to long-horizon agentic vulnerability discovery. Open-weights Chinese frontier models have closed most of the gap to closed-weights Western frontier models on coding and reasoning benchmarks; the gap that remains is narrowing on a quarterly cadence. Whether the relevant adversary is a state-aligned threat actor with access to a domestic frontier model, a financially motivated ransomware crew renting capacity from a permissive cloud, or a sufficiently determined hobbyist running a quantized weights download on a workstation — the offensive analog of Mythos exists or is months from existing. The defensive analog is, today, restricted to nine companies' codebases.

Within the OT sector, the attacker side of this curve has access to all of the same models. The defender side of the curve, for the OT sector, is currently sitting at the public-research level — Mythos-class capability is not in any commercially available OT-vendor toolchain. The asymmetry is not "defenders have a small lead." The asymmetry is "in this specific sector, defenders have no lead at all."

The second compounding direction is discovery debt. Every quarter Mythos runs against AWS or Google codebases is a quarter in which the bug pile in those codebases gets meaningfully smaller. The same quarter is one in which the bug pile in Schneider Electric's Modicon firmware, in Siemens' SIMATIC stack, in Honeywell's Experion, in the dozens of less-famous PLC and DCS lineages that run smaller plants — does not get smaller. Some of those codebases haven't been seriously audited since they were originally certified. The discovery debt is real, growing, and being paid down on the cloud side and not the OT side.

There is a related issue that nobody likes to discuss in public: the insurability of critical infrastructure. The cyber insurance market repriced ICS coverage hard after the 2021–2024 wave of OT incidents, and renewal pricing in 2026 already assumes that operators will adopt every available defensive technology. A line item in a renewal questionnaire that reads "do you have access to AI-assisted continuous vulnerability discovery for your control systems?" has a different answer for a Glasswing partner than for a regional water authority. As that question becomes standard — and the carrier industry is moving in that direction — the operators excluded from programs like Glasswing will face higher premiums, narrower coverage, and in some segments, denied coverage. The asymmetry will be felt at the balance sheet before it is felt at the substation.

What "Including OT" Would Actually Look Like

It would not be enough for Anthropic to add Siemens and Honeywell to the Glasswing partner list and call it done. The OT inclusion problem has technical, governance, and incentive dimensions that all need separate attention.

On the technical side, Mythos in its current form is a model accessed via API. OT analysis frequently requires access to firmware images that vendors will not transmit over the public internet under any circumstances, build environments that depend on specific hardware-in-the-loop fixtures, and target binaries that only run on a narrow set of physical CPUs. A productive OT-Glasswing program would need either an air-gapped on-premises deployment of Mythos, a vendor-controlled enclave model where the vendor brings the codebase to Anthropic's secure compute, or a hybrid in which a smaller bootstrapped model runs on-prem and only escalates carefully-redacted artifacts to the full Mythos capability. None of these is impossible. None of these is what Anthropic ships today.

On the governance side, the bug-handling pipeline for OT findings is fundamentally different. A Mythos finding in AWS code goes from discovery to internal advisory to patch deployment in days. An OT finding goes through ICS-CERT coordination, vendor advisory drafting, customer notification windows that may last months, and physical-world patching that may take longer. The information has to be held for the duration. The disclosure timeline has to be designed around safe physical deployment rather than around 90-day soft deadlines. This is solvable — the established ICS-CERT process exists for exactly this reason — but it requires Anthropic to integrate with that process rather than operate adjacent to it.

On the incentive side, OT vendors do not, today, have the budget structure to pay frontier-AI-lab-grade fees for security tooling. The Glasswing engagements that the cloud partners are running are reportedly priced in the seven-to-eight-figure range. That number is reasonable for AWS. It is not reasonable for an industrial automation business unit operating on industrial-margin economics. A version of Glasswing for OT would either need to be subsidized — by Anthropic, by the Department of Energy's CESER program, by sector ISACs, or by some combination — or it would need to be priced on a fundamentally different model that recognized the smaller revenue base of the customer.

There is a public-policy lever here that has not yet been pulled. CESER and CISA have both been vocal about the need for AI-assisted vulnerability discovery in critical infrastructure. Neither has yet announced a program that would underwrite the cost of bringing OT vendors into Glasswing-equivalent engagements. A federal cost-share — even at 50% — would change the affordability math meaningfully. Whether that program emerges in the back half of 2026 is one of the more important policy questions of the year, and it has had remarkably little public discussion outside trade press.

Three Scenarios for the Next Twelve Months

The Glasswing-OT gap can close in several different ways. Three scenarios feel plausible enough to take seriously, and they have very different consequences for who carries the risk in the meantime.

Scenario A: Anthropic-led expansion (probability ~35%). Anthropic, under sustained pressure from CISA, the DOE national labs, and the OT trade press, announces a Glasswing-OT track in Q3 2026 with three to five tier-1 industrial automation vendors as initial participants. Pricing is structured as a multi-year cost-share with a federal partner. Findings flow through a modified ICS-CERT pipeline. The first major OT-relevant CVE attributed to a Glasswing-OT engagement appears in a Q4 2026 advisory. This is the cleanest path. It also requires Anthropic to take on engineering and legal risk it has so far avoided.

Scenario B: Federal alternative (probability ~35%). The Department of Energy, working through the CESER cybersecurity program and the national labs, stands up a publicly funded equivalent of Glasswing using either an open-weights frontier model or a contracted closed-weights deployment from a competing lab. The program is structured as a public good rather than a commercial engagement. OT vendors participate at no cost. Findings are coordinated through the existing ICS-CERT disclosure process. This path is slower than Scenario A but more durable, and it sidesteps Anthropic's commercial constraints. The trade-off is that federal procurement timelines are measured in years, not quarters.

Scenario C: The gap holds and gets exploited (probability ~30%). No expanded program emerges in 2026. A major OT incident — ransomware against a regional utility, a state-aligned attack against pipeline operators, a manipulation of safety systems at a chemical facility — occurs in late 2026 or early 2027 and post-incident analysis identifies a vulnerability class that Mythos-equivalent tooling would have caught. The political response forces an emergency expansion of access on terms that nobody — Anthropic, the OT vendors, the federal government — would have negotiated voluntarily. This is the worst of the three scenarios because it pays for the asymmetry in physical-world consequences first and policy correction second.

The probabilities are subjective and the boundaries between scenarios blur in practice — Scenario A could happen in parallel with Scenario B, and Scenario C could partially happen even if A or B is in motion. What matters for risk management is that the combined probability of "the gap closes voluntarily before something bad happens" is, generously, around 70%. That leaves a non-trivial residual risk that the gap closes the other way.

What OT Operators Should Be Doing While the Gap Persists

Operators of critical infrastructure cannot wait for either Anthropic or the federal government to fix this for them. The realistic action set in the meantime has five elements, none of them new but all of them more urgent in light of Glasswing.

Inventory firmware aggressively. The single most expensive sentence an OT security manager will hear in the next twelve months is "we did not know that was running on a controller." The Mythos-equivalent tooling that adversaries are starting to deploy targets exactly the kinds of forgotten firmware that show up in plant audits. A current, accurate, version-stamped inventory of every PLC, RTU, HMI, and edge gateway is the precondition for everything else.

Tighten the network boundary. OT segmentation has improved dramatically since the Triton incident, but the median plant still has more east-west connectivity in its control network than its threat model accounts for. Assume the firmware is vulnerable. Assume Mythos-equivalent tooling will find what is vulnerable. Make the routing and segmentation choices that contain the blast radius when, not if, exploitation happens.

Build a vendor-update relationship that can move faster than annual. The traditional OT vendor relationship is structured around predictable annual support cycles. The Mythos era requires a vendor relationship in which a critical advisory can move from discovery to deployment in weeks, not seasons. This is a procurement question as much as a technical one. Renegotiate the support agreement. Pre-authorize emergency patching procedures. Have the change-control board pre-approve a class of out-of-band actions for critical advisories. Most operators have not done this work yet.

Engage the public sector now. CISA, ICS-CERT, and the relevant sector ISAC are actively pushing for engagement. Operators who have already established a working relationship with these bodies will be first in line for whatever Federal alternative emerges. Operators who are first establishing that relationship after an incident will not.

Demand transparency from vendors about their own AI-assisted security posture. A reasonable question on every OT vendor renewal in 2026 is "what is your roadmap for incorporating AI-assisted vulnerability discovery into your secure development lifecycle?" If the answer is a marketing slide, that is information. If the answer is a credible engineering plan, that is also information. Operators can drive vendor behavior through procurement pressure that they are not yet exerting.

This is the pragmatic floor. None of it substitutes for actual access to Mythos-class tooling. All of it reduces the cost of the asymmetry while the asymmetry persists.

Historical Precedents That Should Worry Us

The pattern of "powerful defensive technology arrives in the cloud, takes years to reach OT" is not new. It is, in fact, the dominant pattern of the last fifteen years of cybersecurity. Watching the precedents helps calibrate how seriously to take the Mythos version.

The first analog is EDR. Endpoint detection and response, in its modern form, was a 2014–2016 enterprise IT capability. By 2018 it was standard at every Fortune 500 IT organization. By 2020 it was being seriously deployed in OT environments — a four-to-six-year gap during which adversaries already understood the IT-side product surface and used unprotected OT endpoints as a soft middle. The cost of that gap was paid in the Triton, Industroyer2, and Industroyer.V2 incidents, all of which exploited OT environments still running on a defensive posture five years older than their IT siblings.

The second analog is ATT&CK for ICS. MITRE's ICS-specific threat-modeling framework launched four years after the IT-side ATT&CK framework. The gap between the two was not because OT was less important — it was because the resourcing decision at MITRE, reasonably enough, started where the customers and funding were. The OT framework eventually caught up. The lag was real and the consequences were real: every major OT incident in the 2018–2021 window was analyzed in IT-ATT&CK terminology, with all the impedance mismatch that implied.

The third analog is vendor SBOM disclosure. Software bill of materials emerged as an enterprise-software requirement in 2021 and was effectively mandated for federal IT procurement by 2022. SBOMs for OT firmware are still, in 2026, a roadmap item for most industrial vendors. The gap there is at least three years and counting.

The bad news is that a two-year IT-to-OT gap, applied to Mythos-class capability, would put broad OT availability in 2028 — which is well past the window in which the offensive analog of Mythos is in adversary hands. The good news is that the historical pattern is not a law of nature. It compresses when there is sufficient public-sector pressure (the SBOM compression to four years happened because the federal government decided to compress it) and it compresses dramatically when there is a precipitating incident. Whether the compression for Mythos-class capability comes before or after a precipitating incident is, again, the central question.

A Note on the Trust Calculation

There is a deeper reason the OT exclusion matters that I have so far skirted around. AI labs are, increasingly, choosing who gets defended. Glasswing is not the first such choice — Microsoft's Copilot for Security launch list, OpenAI's enterprise security partnerships, Google's Mandiant integrations all involved similar prioritization decisions — but it is the most visible because the capability gap between Mythos and conventional tooling is the largest. The labs are operating, de facto, as a new layer of cybersecurity infrastructure, with a partner-selection process that determines who benefits from that infrastructure first.

The OT sector's discomfort with this is not really about Anthropic. It is about the realization that the institutions setting the pace of defensive cybersecurity for the 2026–2030 window are private commercial entities whose partner-selection logic is opaque and whose accountability runs to investors rather than to the public. There is a long-running trust deficit conversation about autonomous AI accountability that has mostly focused on how AI agents make decisions inside enterprises. Glasswing is the first really large example of frontier labs themselves making decisions whose distributional consequences fall on infrastructure operators who never signed up to be part of an AI lab's prioritization queue.

This is not a problem that Anthropic alone can solve. It is also not a problem Anthropic gets to ignore. The same dynamic that produced the agent governance gap analysis we ran two days ago — where Microsoft's Agent 365 control plane became the de facto governance layer for enterprise agents because no public-sector alternative existed — is now producing a Mythos-shaped vulnerability discovery layer for some sectors and not others. The labs are setting policy through product decisions. The democratic institutions that should be checking that policy are, as they have been throughout this cycle, several quarters behind.

The Falsifiable Take

The Glasswing Asymmetry resolves one of three ways within the next eight to ten months. Either Anthropic announces an OT-track expansion before the end of 2026, or a federal alternative gets meaningfully off the ground at DOE or CISA, or there is a critical-infrastructure incident whose post-mortem includes the phrase "Mythos-equivalent tooling would likely have detected this." My corresponding prediction commits to a specific resolution date and probability, with a clear scoring rubric. If you believe the asymmetry will close cleanly and quickly, that prediction will read as too pessimistic by Q1 2027. If you believe it will close the hard way, that prediction will read as optimistic. Either way, this is the kind of editorial decision frontier labs are now making whose consequences will be measured in physical-world terms, and the public conversation about it deserves to be louder than it currently is.

Anthropic's launch of Mythos was, in capability terms, an extraordinary achievement. The choice of who got to use it first is a separate decision, made for understandable reasons, with consequences that will not stay confined to the partner roster. The asymmetry has a name now. The next move belongs to the institutions — public and private — that decide whether the people running the physical world get the same defensive tools as the people running the cloud.

For the avoidance of doubt: this is not a complaint about Anthropic's capability or intentions. The Mythos team built something genuinely remarkable, and the Glasswing partner roster, taken on its own terms, is reasonable. The asymmetry is a structural problem that no single lab can be expected to solve alone, and a structural problem that — left unaddressed — will produce a structural failure. The question on the table is whether the institutions in a position to act will recognize the structural problem before the structural failure occurs, or after.

Further Reading

• The Trust Deficit: Why Autonomous AI Agents Need Verifiable Accountability Before Enterprise Adoption — The broader accountability question of which Glasswing's partner-selection problem is one specific case.
• Agent Governance Gap: Microsoft Agent 365 and the De Facto Control Plane — How private platforms become public-policy infrastructure when public alternatives lag.
• Agent Authentication Crisis: 97M MCP Installs and the Identity Breach Wave — The other half of the AI cybersecurity story: even when defenders have great tools, identity gaps undo the protection.

Hero Image — Leonardo.ai

Leonardo.ai Settings

• Model: Lucid Realism
• Prompt Enhance: Auto
• Style: Dynamic
• Ratio: 16:9
• Size: Large
• Number of Images: 4

Prompt

Extreme macro photography revealing the internal lattice structure of a glass wing fragment, scientific microscopy aesthetic, intricate cellular venation visible under transmitted light, deep amber and pale gold tones with cool slate shadows, fine refractive prismatic edges, shallow depth of field with one perfectly sharp central detail surrounded by gentle bokeh, no text, no logos, no words, no numbers, no rendered glyphs, no human figures, no machinery, no circuit board patterns, no holographic interfaces, no blue tech glow, real material photographed with a research microscope, dust motes suspended in a single beam of light, the suggestion of fragility coexisting with precision, 16:9 cinematic framing, museum-quality scientific imagery.

Anti-Cliche Guards

Avoid: blue/cyan tech aesthetic, data center visuals, holographic interfaces, matrix/circuit patterns, silhouettes in tech environments, glowing orbs, generic futuristic aesthetic.