Does Project Glasswing Expose P&C Industry’s Glass Jaw?

n early April, Anthropic made headlines with reports that its latest AI model, Mythos Preview, “has already found thousands of high-severity [cyber] vulnerabilities, including some in every major operating system and web browser.”¹ The model identified and crafted exploits for vulnerabilities unscathed by decades of security research. Anthropic subsequently launched Project Glasswing in collaboration with over 50 companies, such as Amazon, Apple, and Google, to help fortify their defensive postures using the Mythos Preview. Mythos may be a warning sign for a market defined by “sustained softening,”² but opinions remain divided regarding whether it represents a true step change in offensive capability.

Some security experts say much of Mythos’s discovery capability was already available through savvy orchestration³ of existing models for months if not a full year. Offensive security platform XBOW, which was invited by Anthropic to evaluate Mythos, found that it significantly outperforms predecessors in discovering “validated, actionable vulnerabilities in live website environments.”⁴ Figure 1 displays the estimated chance of discovery based on XBOW’s report at various output token budgets.⁵

At higher budgets, the models begin to converge, especially between Mythos and its direct predecessor, Opus 4.6.

Mythos’ exploitation capabilities appear to be more novel than its discovery capabilities. AI Security Institute (AISI) found that Mythos succeeded in 73% of expert-level⁶ identification and exploitation tasks — tasks that no model could complete before April 2025. Mythos succeeded three out of 10 times and completed an average of 22 out of 32 steps of The Last Ones (TLO) corporate network attack simulation. Figure 2 compares Mythos’s performance to that of other models at different token consumption.⁷

While no other model completed TLO at any budget, Mythos’ successful completion required multiple tries and extensive computational resources. Other models achieved results similar to that of Mythos in lower budget ranges. AISI credited Mythos for its strong autonomous attacking capability against weakly defended systems but “cannot say for sure whether Mythos Preview would be able to attack well-defended systems.” Project Glasswing itself illustrates a growing viewpoint that AI may empower defense⁸ more than offense.

Reports of unauthorized access to Mythos heightened concern in a cyber insurance market already sensitive⁹ to the possibility that AI-enabled actors could identify and exploit vulnerabilities before policyholders or suppliers can detect and remediate them. The rise of ransomware in the early 2020s yielded a sharp pricing correction after annual insured losses¹⁰ grew from $500 million in 2019 to between $4 billion and $6 billion in 2025. AI systems such as Mythos, potentially amplified by autonomous agents¹¹ operated by less sophisticated threat actors, could represent the next change by lowering the barriers¹² to effective cyberattacks.

Actuaries may consider revisiting frequency assumptions both generally and within catastrophe models, particularly where upstream points of failure, such as Amazon Web Services or Microsoft Azure, have contributed to recent near-miss cyber aggregation events.¹³ Vulnerability and resilience covariates¹⁴ may also assume greater importance in pricing and exposure models.