Glasswing Partners Retain Mythos Preview Despite US Shutdown

A US government export control directive that gave Anthropic roughly 90 minutes to disable its most capable commercial models on June 12 has produced an unexpected second chapter. Bloomberg reports that approximately 200 organizations in Anthropic's Glasswing cybersecurity program still have access to Mythos Preview, the pre-commercial release of the same frontier model that developers, enterprises, and paying customers around the world lost almost instantly when the order hit.

Project Glasswing launched in April with twelve founding partners, including Amazon, Apple, Cisco, CrowdStrike, Google, Microsoft, NVIDIA, and Palo Alto Networks, and has since grown to roughly 200 organizations. The preview model is designed to find and exploit software vulnerabilities at a level above most human experts, and in its first month Glasswing partners reportedly uncovered over 10,000 high- or critical-severity flaws across their software, with hundreds disclosed to maintainers and dozens patched with public advisories. That capability is precisely what US national security authorities say concerns them: their stated position is that there may be ways to bypass safeguards built into the models and use them to identify vulnerabilities in US critical infrastructure.

The directive targeted the publicly released commercial versions, which is what kept Mythos Preview technically out of scope. Dragos and Cisco confirmed to Bloomberg they retained access. On the other side, ENISA, the European Union's cybersecurity agency, was told it would no longer receive access despite a prior invitation to join Glasswing, suggesting the carve-out tracks US-aligned membership rather than the broader defensive-purpose framing the program was built on.

The honest caveat is that the reporting doesn't explain how Anthropic is making individual access decisions within Glasswing, and the criteria are opaque. Foreign nationals employed at US Glasswing partners may or may not fall under the directive's restrictions, creating real legal exposure for the companies involved. What the reporting also doesn't give you is any confirmation that the government formally approved this two-tier outcome, rather than Anthropic simply finding that the directive's text didn't cover the preview version.

For companies inside Glasswing, the asymmetry is real and compounding: the firms still running Mythos-class vulnerability discovery are best positioned to charge for remediating flaws that everyone else cannot yet see. Anthropic's relationship with the current administration is already described as strained after the company declined military requests to use its models for domestic surveillance and fully autonomous weapons systems. How the government responds to a frontier model technically still operating for 200 vetted partners will likely shape how the US distributes access to the most sensitive AI capabilities for years.