Anthropic Expands Claude Access for Vetted Cyber Teams After Glasswing Finds 129,000 Vulnerabilities
What Happened — Anthropic announced it is widening a program that lets vetted cybersecurity professionals interact with its Claude large‑language model using reduced safeguards and blocking classifiers. The initiative, called Project Glasswing, reported the discovery of at least 129,000 verified software vulnerabilities in Anthropic’s AI stack between April and July 2026.
Why It Matters for Trust & Control Assurance
- The volume of flaws highlights the need for continuous AI‑model risk monitoring—a control area that provides ongoing evidence of safe model behavior.
- Mapping AI‑governance controls to frameworks such as NIST AI RMF or ISO 42001 creates a single, auditable control objective that satisfies many regulatory regimes.
- Demonstrating a structured, repeatable process for third‑party AI testing supplies defensible audit trails for both internal governance and external assessments.
Who Is Affected — AI SaaS providers, enterprises that embed generative AI in products or services, and security consultancies that perform model‑testing engagements.
Recommended Actions
- Incorporate AI‑model risk assessments into your continuous control‑assurance workflow.
- Capture and retain evidence of vulnerability remediation, test‑case results, and policy exceptions for audit readiness.
- Align your AI‑governance controls with a common framework spine (VCF) to simplify multi‑framework reporting.
Source: The Hacker News
Technical Notes
- The program reduces safety‑layer classifiers, exposing the model to edge‑case inputs that can trigger hidden software bugs.
- Discovered issues span code injection vectors, privilege‑escalation paths in model‑serving infrastructure, and data‑leakage risks from prompt handling.
Source: The Hacker News