Economics paper finds Project Glasswing firms disclosed twice as many vulnerabilities

Thomas Mosk posted an economics working paper to arXiv on 4 November, Does Frontier AI Strengthen Cyber Defense? Evidence from Project Glasswing. It is a single-author submission listed under general economics, with no journal reference, and it has not been peer reviewed. It is an attempt to test with public data the claim behind Project Glasswing: that giving defenders early access to a strong vulnerability-finding model helps them more than it helps attackers.

The study treats the programme’s launch as a natural experiment. Anthropic gave a small group of large US technology firms early access to Claude Mythos Preview, and the paper compares their vulnerability disclosures, using all publicly disclosed vulnerabilities, with those of Chinese and Russian technology firms that did not have it.

By the abstract’s account, firms with access more than doubled their disclosures relative to the comparison group and disclosed about 150% more high-impact vulnerabilities, while the speed of fixing was unchanged. External bug-bounty researchers reported about half as many vulnerabilities in the treated firms’ code, and more in other firms’ code. The paper found no evidence that attackers exploited the additional flaws: the share of vulnerabilities exploited within a month of disclosure fell by about two thirds, mainly because fewer had already been exploited by the time they were disclosed. It also concludes that the restricted release creates a software-security asymmetry between firms in different countries.

The design has limits that follow from its own structure. The comparison group differs from the treated firms in nationality and in much else besides model access, and a drop in prior exploitation could reflect changes in how firms disclose as well as in what attackers do. A single unreviewed paper is also thin evidence beside Anthropic’s own reporting, such as its May update, which said Mythos-found bugs rated high or critical took two weeks on average to fix.

The paper is an outside attempt to measure the defender-advantage argument behind restricted cyber releases. It appeared about a week after Anthropic described five exploit chains built by an unreleased model.